# Kubernetes

Kubernetes connections enable integration with Kubernetes clusters for health checks, configuration scraping, and playbook automation.

## Used By[​](#used-by "Direct link to Used By")

* [Kubernetes Config Scraper](/docs/guide/config-db/scrapers/kubernetes.md) - Scrape Kubernetes resource configurations
* [Pod Exec Action](/docs/guide/playbooks/actions/exec.md) - Execute commands in pods
* [Playbook Actions](/docs/guide/playbooks/actions/.md) - Execute Kubernetes automation

| Field        | Description                                                     | Scheme                                                            |
| ------------ | --------------------------------------------------------------- | ----------------------------------------------------------------- |
| `cnrm`       | CNRM connection details                                         | [CNRM](/docs/reference/connections/kubernetes.md#cnrm-connection) |
| `connection` | The connection url to use, mutually exclusive with `kubeconfig` | [Connection](/docs/reference/connections/.md)                     |
| `eks`        | EKS connection details                                          | [EKS](/docs/reference/connections/kubernetes.md#eks-connection)   |
| `gke`        | GKE connection details                                          | [GKE](/docs/reference/connections/kubernetes.md#gke-connection)   |
| `kubeconfig` | Source for kubeconfig                                           | [EnvVar](/docs/reference/env-var.md)                              |

note

One of the connection types must be provided: kubeconfig, EKS, GKE, or CNRM.

## Connection Types[​](#connection-types "Direct link to Connection Types")

### Kubeconfig[​](#kubeconfig "Direct link to Kubeconfig")

Connect using a kubeconfig file:

```
kubeconfig-connection.yaml
apiVersion: mission-control.flanksource.com/v1

kind: Connection

metadata:

  name: remote-cluster

spec:

  kubernetes:

    kubeconfig:

      valueFrom:

        secretKeyRef:

          name: cluster-credentials

          key: kubeconfig
```

### EKS Connection[​](#eks-connection "Direct link to EKS Connection")

Connect to Amazon EKS clusters:

| Field           | Description                                                                    | Scheme                                        |
| --------------- | ------------------------------------------------------------------------------ | --------------------------------------------- |
| `cluster*`      | Name of the EKS cluster                                                        | `string`                                      |
| `accessKey`     | Access Key ID                                                                  | [EnvVar](/docs/reference/env-var.md)          |
| `assumeRole`    | Role ARN to assume                                                             | `string`                                      |
| `connection`    | The connection url to use, mutually exclusive with `accessKey` and `secretKey` | [Connection](/docs/reference/connections/.md) |
| `endpoint`      | Custom AWS Endpoint to use                                                     | `string`                                      |
| `region`        | The AWS region                                                                 | `string`                                      |
| `secretKey`     | Secret Access Key                                                              | [EnvVar](/docs/reference/env-var.md)          |
| `sessionToken`  | Session token                                                                  | [EnvVar](/docs/reference/env-var.md)          |
| `skipTLSVerify` | Skip TLS verify when connecting to AWS                                         | `boolean`                                     |

```
eks-connection.yaml
apiVersion: mission-control.flanksource.com/v1

kind: Connection

metadata:

  name: eks-production

spec:

  kubernetes:

    eks:

      cluster: my-eks-cluster

      region: us-east-1

      accessKey:

        valueFrom:

          secretKeyRef:

            name: aws-credentials

            key: AWS_ACCESS_KEY_ID

      secretKey:

        valueFrom:

          secretKeyRef:

            name: aws-credentials

            key: AWS_SECRET_ACCESS_KEY
```

### GKE Connection[​](#gke-connection "Direct link to GKE Connection")

Connect to Google Kubernetes Engine clusters:

| Field           | Description                                                      | Scheme                                        |
| --------------- | ---------------------------------------------------------------- | --------------------------------------------- |
| `cluster*`      | Name of the GKE cluster                                          | `string`                                      |
| `project*`      | GCP project ID                                                   | `string`                                      |
| `zone*`         | GCP zone where the cluster is located                            | `string`                                      |
| `connection`    | The connection url to use, mutually exclusive with `credentials` | [Connection](/docs/reference/connections/.md) |
| `credentials`   | The credentials to use for authentication                        | [EnvVar](/docs/reference/env-var.md)          |
| `endpoint`      | Custom GCP Endpoint to use                                       | `string`                                      |
| `skipTLSVerify` | Skip TLS verification when connecting to GCP                     | `boolean`                                     |

```
gke-connection.yaml
apiVersion: mission-control.flanksource.com/v1

kind: Connection

metadata:

  name: gke-production

spec:

  kubernetes:

    gke:

      project: my-gcp-project

      zone: us-central1-a

      cluster: my-gke-cluster

      credentials:

        valueFrom:

          secretKeyRef:

            name: gcp-credentials

            key: service-account.json
```

### CNRM Connection[​](#cnrm-connection "Direct link to CNRM Connection")

Connect via Config Connector for GCP-managed clusters:

| Field                       | Description                                                       | Scheme                 |
| --------------------------- | ----------------------------------------------------------------- | ---------------------- |
| `clusterResource*`          | Name of the ContainerCluster resource managed by Config Connector | `string`               |
| `clusterResourceNamespace*` | Namespace containing the ContainerCluster resource                | `string`               |
| `gke.cluster*`              | Name of the management GKE cluster                                | `string`               |
| `gke.projectID*`            | Google Cloud project ID containing the management GKE cluster     | `string`               |
| `gke.zone*`                 | Zone or region where the management GKE cluster is located        | `string`               |
| `clusterResource`           | Name of the cluster resource in Config Connector                  | `string`               |
| `clusterResourceNamespace`  | Namespace of the cluster resource                                 | `string`               |
| `gke`                       | GKE connection details                                            | [GKE](#gke-connection) |