> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudgeni.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubernetes Setup

> Connect a Kubernetes cluster with a read-only kubeconfig and verify inventory and compliance access.

# Kubernetes Setup

Cloudgeni connects to one Kubernetes cluster context per integration. Create a separate integration
for each cluster you want to inventory or scan.

## Supported Credentials

Use a kubeconfig containing one of these non-interactive credential forms:

* A static bearer token for a read-only service account
* Inline client certificate and private-key data

Kubeconfigs that depend on `exec` plugins, legacy auth-provider refresh commands, local certificate
paths, username/password authentication, or insecure TLS verification are not accepted.

## Create The Integration

1. Choose the target workspace, open `Integrations`, and select **Cloud**.
2. Choose **Connect Kubernetes**.
3. Enter the cluster name and paste the kubeconfig.
4. Select a context when the kubeconfig contains more than one.
5. Optionally restrict the accepted API-server hosts or CIDR ranges.
6. Run the connection probe and review any reachability or permission warnings.
7. Save the integration, then run a resource sync.

The form includes a **Need a compatible kubeconfig?** guide that generates a read-only service
account manifest and commands for producing a static-token kubeconfig. Its role grants only
`get`, `list`, and `watch` access to the resource types Cloudgeni scans.

## Connectivity

The Kubernetes API server must be reachable from the scanner used by your workspace. A private API
server may pass credential validation but remain unreachable from the hosted scanner. Use the
Cloudgeni in-cluster connector when it is enabled for your deployment, or make the API endpoint
reachable through your approved network path.

## What Kubernetes Enables

* Live cluster resource inventory and topology
* Comparison with Kubernetes, Helm, Kustomize, or Terraform desired state
* CIS Kubernetes 1.11.1, SOC 2, ISO 27001:2022, and NIS2 framework views when the corresponding
  compliance scan data is available

Cloudgeni stores Secret metadata but removes Kubernetes Secret `data` and `stringData` values from
the inventory.

## Troubleshooting

* **Authentication failed:** replace an `exec`-based kubeconfig with a static service-account token.
* **Permission probe warns:** grant the read-only role generated by the setup guide.
* **Cluster is unreachable:** verify DNS, TLS, firewall rules, and the selected scanner/connector
  network path.
* **Wrong cluster appears:** set the intended context explicitly or create a single-context
  kubeconfig.