Skip to main content

​
Kubernetes Setup

Cloudgeni connects to one Kubernetes cluster context per integration. Create a separate integration for each cluster you want to inventory or scan.

​
Supported Credentials

Use a kubeconfig containing one of these non-interactive credential forms:
  • A static bearer token for a read-only service account
  • Inline client certificate and private-key data
Kubeconfigs that depend on exec plugins, legacy auth-provider refresh commands, local certificate paths, username/password authentication, or insecure TLS verification are not accepted.

​
Create The Integration

  1. Choose the target workspace, open Integrations, and select Cloud.
  2. Choose Connect Kubernetes.
  3. Enter the cluster name and paste the kubeconfig.
  4. Select a context when the kubeconfig contains more than one.
  5. Optionally restrict the accepted API-server hosts or CIDR ranges.
  6. Run the connection probe and review any reachability or permission warnings.
  7. Save the integration, then run a resource sync.
The form includes a Need a compatible kubeconfig? guide that generates a read-only service account manifest and commands for producing a static-token kubeconfig. Its role grants only get, list, and watch access to the resource types Cloudgeni scans.

​
Connectivity

The Kubernetes API server must be reachable from the scanner used by your workspace. A private API server may pass credential validation but remain unreachable from the hosted scanner. Use the Cloudgeni in-cluster connector when it is enabled for your deployment, or make the API endpoint reachable through your approved network path.

​
What Kubernetes Enables

  • Live cluster resource inventory and topology
  • Comparison with Kubernetes, Helm, Kustomize, or Terraform desired state
  • CIS Kubernetes 1.11.1, SOC 2, ISO 27001:2022, and NIS2 framework views when the corresponding compliance scan data is available
Cloudgeni stores Secret metadata but removes Kubernetes Secret data and stringData values from the inventory.

​
Troubleshooting

  • Authentication failed: replace an exec-based kubeconfig with a static service-account token.
  • Permission probe warns: grant the read-only role generated by the setup guide.
  • Cluster is unreachable: verify DNS, TLS, firewall rules, and the selected scanner/connector network path.
  • Wrong cluster appears: set the intended context explicitly or create a single-context kubeconfig.