Configure Kubernetes

An agent can read Namespaces, Nodes, Pods, Deployments, Services, and Events within the credentials’ permissions to inspect cluster state.

Prerequisites

Prepare a cluster and target namespace, administrator-provided read-only credentials, the API Server address, its certificate-authority information, MOI tool-configuration permissions, and network access from MOI to the API Server.

Use a test cluster and restricted credentials for initial setup. Do not copy a personal production-administrator kubeconfig into the form.

1. Obtain connection information

Information

Purpose

API Server

Cluster API URL, such as https://k8s.example.com:6443, rather than a management-console URL

Namespace

The namespace whose resources you need to read

Token or client certificate and private key

Authentication; choose one method

API Server CA

Verifies the server certificate, including a cluster’s private CA when applicable

Credential expiry and permissions

Establishes current validity and access to the required resources

ServiceAccount identity and resource permissions are configured separately. See Kubernetes ServiceAccounts.

2. Open the MOI form

Open Resource Center → Tools → Kubernetes and create an instance. Enter a recognizable name, such as “Test cluster.” Fill connection information from kubeconfig or enter it manually.

Option A: fill from kubeconfig

  1. Select Fill from kubeconfig and choose a file, or paste YAML or JSON into the text area on the right and select Use pasted kubeconfig.

  2. If prompted, select the context for the intended cluster.

  3. Review the populated API Server, default namespace, authentication method, and CA.

Populating fields does not save the instance. Import currently does not support exec, auth-provider, tokenFile, or external certificate-file paths. Ask for a kubeconfig with supported embedded credentials or enter the connection manually.

Option B: enter fields manually

  1. Enter the API Server and default namespace.

  2. Select ServiceAccount Bearer Token or Client certificate and provide the corresponding credentials.

  3. Enter the required CA. If a TLS Server Name is needed, expand Advanced TLS settings and use the administrator-supplied name.

Field

Requirement

Value

API Server

Required

The cluster API address

Authentication method

Required

ServiceAccount Bearer Token or client certificate

Bearer Token

Required in token mode

Raw administrator-provided ServiceAccount token

Client certificate / private key

Required in certificate mode

Certificate as PEM or file upload; the private-key text field accepts Base64 client-key-data, while PEM private keys use file upload

Default Namespace

As needed

Fallback for namespaced reads without an explicit namespace; does not grant access

API Server CA / TLS Server Name

As needed

Administrator-provided certificate and name-verification settings

3. Save and test

Check the API Server, namespace, and credential expiry, save, and run the connection test. Correct network, certificate, or permission issues based on the error and retry. A successful test does not grant or prove access to every resource.

4. Bind and validate

Bind the tool and select the target instance. Ask: “Using the Test cluster instance, list Pod names and status in the test namespace. Do not modify resources.” Replace test with the intended namespace.

Compare the call record and returned names and status with the cluster’s actual Pod list. Confirm the cluster identity rather than relying on a configured badge.

Troubleshoot

Symptom

Check

kubeconfig import fails

Unsupported exec, auth-provider, tokenFile, or external certificate paths; obtain supported embedded credentials

Certificate error

CA, endpoint, and certificate hostname; do not skip TLS verification

403

Ask the administrator for the minimum RBAC permissions required for the specified reads

Expiry or 401

Replace the token or certificate, save, and test again
Last updated on