Kubernetes

​

Prerequisites

• A cluster whose API server CloudThinker can reach over the internet. Commands run in the CloudThinker cloud, so a private-only endpoint fails the connection test. If you restrict API access (EKS public access CIDRs, GKE authorized networks, AKS authorized IP ranges), add CloudThinker’s egress IPs instead of opening it to 0.0.0.0/0. These docs don’t publish CloudThinker’s egress IP list: ask your CloudThinker contact, or contact us. See Reaching private services for other options.
• kubectl access to that cluster with permission to create a namespace, a ClusterRole, and a ClusterRoleBinding.
• Managed clusters (EKS, GKE, AKS) hand out kubeconfigs that sign in through aws, gcloud, or az exec plugins, which don’t work in CloudThinker. Step 2 builds one that does. Kubernetes checks the service-account token itself, so you don’t map it in cloud IAM (no EKS access entry, for example).
• Optional: Metrics Server in the cluster. Without it, agents still report pod status and node conditions, but not live CPU and memory usage.
• The Admin role in your CloudThinker workspace, which can add and edit connections. See Roles.

​

Setup

apiVersion: v1
kind: Namespace
metadata:
  name: cloudthinker
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: cloudthinker-reader
  namespace: cloudthinker
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cloudthinker-reader
rules:
- apiGroups: [""]
  resources: ["pods", "pods/log", "nodes", "namespaces", "services", "endpoints", "events", "configmaps", "persistentvolumeclaims", "persistentvolumes", "resourcequotas", "limitranges", "serviceaccounts", "replicationcontrollers"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
  resources: ["deployments", "replicasets", "statefulsets", "daemonsets"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["batch"]
  resources: ["jobs", "cronjobs"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["autoscaling"]
  resources: ["horizontalpodautoscalers"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["networking.k8s.io"]
  resources: ["ingresses", "networkpolicies"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["policy"]
  resources: ["poddisruptionbudgets"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["storage.k8s.io"]
  resources: ["storageclasses"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["roles", "rolebindings", "clusterroles", "clusterrolebindings"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["metrics.k8s.io"]
  resources: ["pods", "nodes"]
  verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cloudthinker-reader
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cloudthinker-reader
subjects:
- kind: ServiceAccount
  name: cloudthinker-reader
  namespace: cloudthinker
---
apiVersion: v1
kind: Secret
metadata:
  name: cloudthinker-reader-token
  namespace: cloudthinker
  annotations:
    kubernetes.io/service-account.name: cloudthinker-reader
type: kubernetes.io/service-account-token

kubectl apply -f cloudthinker-reader.yaml

SERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
echo $SERVER

CA=$(kubectl get secret cloudthinker-reader-token -n cloudthinker -o jsonpath='{.data.ca\.crt}')
TOKEN=$(kubectl get secret cloudthinker-reader-token -n cloudthinker -o jsonpath='{.data.token}' | base64 --decode)

cat > cloudthinker-kubeconfig.yaml <<EOF
apiVersion: v1
kind: Config
clusters:
- name: target
  cluster:
    server: ${SERVER}
    certificate-authority-data: ${CA}
users:
- name: cloudthinker-reader
  user:
    token: ${TOKEN}
contexts:
- name: cloudthinker
  context:
    cluster: target
    user: cloudthinker-reader
current-context: cloudthinker
EOF

​

Connection details

​

Required permissions

​

Write access

• Scale and rollout restart act on namespaced workloads. Use a Role in each namespace involved, with patch on deployments and get plus patch on deployments/scale. For StatefulSets, add the same for statefulsets and statefulsets/scale. For DaemonSets, add daemonsets (restart only, since they don’t scale).
• Apply needs get, create, and patch on each resource type in the manifest you apply, in the namespaces it targets.
• Cordon and drain act on nodes, which are cluster-scoped, so a namespaced Role can’t allow them. Use a ClusterRole with patch on nodes and create on pods/eviction. The read role already supplies the get and list on pods and DaemonSets that drain needs.

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: cloudthinker-scale
  namespace: payments
rules:
- apiGroups: ["apps"]
  resources: ["deployments"]
  verbs: ["patch"]
- apiGroups: ["apps"]
  resources: ["deployments/scale"]
  verbs: ["get", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: cloudthinker-scale
  namespace: payments
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: cloudthinker-scale
subjects:
- kind: ServiceAccount
  name: cloudthinker-reader
  namespace: cloudthinker
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cloudthinker-node-ops
rules:
- apiGroups: [""]
  resources: ["nodes"]
  verbs: ["patch"]
- apiGroups: [""]
  resources: ["pods/eviction"]
  verbs: ["create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: cloudthinker-node-ops
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cloudthinker-node-ops
subjects:
- kind: ServiceAccount
  name: cloudthinker-reader
  namespace: cloudthinker

​

Agent capabilities

​

Verify the connection

Check the Kubernetes connection: list the namespaces, the node count, and any nodes that are not Ready

​

Example prompts

Which pods in the payments namespace are crash-looping, and what do their logs say?
Which nodes are under memory or disk pressure, and what is using the most memory?
Which service accounts are bound to cluster-admin?

​

Rotate the token

apiVersion: v1
kind: Secret
metadata:
  name: cloudthinker-reader-token-2
  namespace: cloudthinker
  annotations:
    kubernetes.io/service-account.name: cloudthinker-reader
type: kubernetes.io/service-account-token

kubectl apply -f cloudthinker-reader-token-2.yaml

kubectl delete secret cloudthinker-reader-token -n cloudthinker

• Agents and scheduled automations can’t use the cluster between the disconnect and the reconnect.
• Discovery runs again and spends credits.
• Allow writes goes back to on. Turn it off again if you had it off.
• Check that Rules naming the Kubernetes connection still list it.

​

Troubleshooting

​

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• Keep Secrets out of the role. The manifest above never grants Secret reads, so agents can’t read Secret objects. Pod logs and ConfigMaps are readable, so drop pods/log or configmaps from the role if they hold sensitive data. Env values set directly in a pod spec are readable through pods, so move sensitive ones into Secrets.
• Rotate the token. The token Secret never expires on its own, so rotate it on your normal schedule. See Rotate the token.
• Revoke in one command. Delete the token Secret to cut access immediately, or delete the cloudthinker namespace plus the ClusterRole and binding to remove everything.

​

Related

Rancher

Read cluster inventory and access across clusters Rancher manages

Kubernetes Health Monitoring

Put this connection to work on a recurring cluster health check

Approvals

Decide which cluster changes run, wait for a person, or are refused

Connections Overview

How connection status, testing, and discovery work