Connect a Kubernetes Cluster to InfraAudit

InfraAudit connects to Kubernetes clusters via a kubeconfig file. Once connected, it syncs deployments, pods, services, namespaces, and more, and supports drift detection when you upload Kubernetes manifests.

Prerequisites

A running Kubernetes cluster (EKS, GKE, AKS, or self-managed)
kubectl installed locally and configured to access the cluster
Permission to create service accounts and ClusterRoleBindings in the cluster

Set up RBAC

Create a dedicated service account with a read-only ClusterRole so InfraAudit only has the access it needs. Save the following as infraudit-rbac.yaml:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: infraudit
  namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: infraudit-reader
rules:
  - apiGroups: ["", "apps", "batch", "networking.k8s.io"]
    resources:
      - pods
      - deployments
      - services
      - namespaces
      - replicasets
      - daemonsets
      - statefulsets
      - jobs
      - cronjobs
      - ingresses
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: infraudit-reader-binding
subjects:
  - kind: ServiceAccount
    name: infraudit
    namespace: kube-system
roleRef:
  kind: ClusterRole
  name: infraudit-reader
  apiGroup: rbac.authorization.k8s.io

Apply it to your cluster:

kubectl apply -f infraudit-rbac.yaml

Generate a kubeconfig for the service account

Run the following script to create a kubeconfig file scoped to the infraudit service account:

# Get the secret name
SECRET=$(kubectl -n kube-system get serviceaccount infraudit \
  -o jsonpath='{.secrets[0].name}')

# Extract the token and CA certificate
TOKEN=$(kubectl -n kube-system get secret $SECRET \
  -o jsonpath='{.data.token}' | base64 -d)
CA=$(kubectl -n kube-system get secret $SECRET \
  -o jsonpath='{.data.ca\.crt}')

# Get the cluster server URL
SERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')

# Write the kubeconfig file
cat > infraudit-kubeconfig.yaml <<EOF
apiVersion: v1
kind: Config
clusters:
  - cluster:
      certificate-authority-data: $CA
      server: $SERVER
    name: infraudit-cluster
contexts:
  - context:
      cluster: infraudit-cluster
      user: infraudit
    name: infraudit-context
current-context: infraudit-context
users:
  - name: infraudit
    user:
      token: $TOKEN
EOF

Kubernetes 1.24 and later no longer create service account token secrets automatically. If the $SECRET variable is empty, generate a token manually with kubectl create token infraudit -n kube-system and use it in place of $TOKEN.

Register the cluster

Open the connection dialog

In the sidebar, click Cloud Providers → Connect Kubernetes.

Upload the kubeconfig

Upload or paste the contents of infraudit-kubeconfig.yaml into the Kubeconfig field.

Name the cluster

Enter a display name (for example, Production EKS).

Connect

Click Connect. InfraAudit validates connectivity and starts the initial resource sync.

infraudit kubernetes register \
  --kubeconfig infraudit-kubeconfig.yaml \
  --name "Production EKS"

KUBECONFIG_CONTENTS=$(cat infraudit-kubeconfig.yaml)

curl -X POST http://localhost:8080/api/v1/providers/kubernetes/connect \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{
    \"name\": \"Production EKS\",
    \"kubeconfig\": \"$KUBECONFIG_CONTENTS\"
  }"

What gets synced

After connecting, InfraAudit discovers and monitors the following Kubernetes resources:

Deployments, ReplicaSets, DaemonSets, StatefulSets
Pods and their current status
Services (ClusterIP, NodePort, LoadBalancer)
Namespaces
Jobs and CronJobs
Ingresses

The sync runs every 6 hours by default. You can trigger a manual sync at any time from Cloud Providers in the sidebar.

Multi-cluster support

Connect each cluster as a separate provider entry. All clusters appear together in the unified Kubernetes view, filterable by cluster name. There is no limit to the number of clusters you can register within your plan’s resource limit.

Security notes

The kubeconfig is encrypted at rest using AES-GCM.
InfraAudit never creates, modifies, or deletes any Kubernetes resources. All operations are read-only.
Rotate the service account token periodically and update the kubeconfig in InfraAudit when you do.

Get Started

Platform

Integrations

Concepts

Self-Hosting

Resources

Connect a Kubernetes Cluster to InfraAudit

Prerequisites

Set up RBAC

Generate a kubeconfig for the service account

Register the cluster

What gets synced

Multi-cluster support

Security notes

​Prerequisites

​Set up RBAC

​Generate a kubeconfig for the service account

​Register the cluster

​What gets synced

​Multi-cluster support

​Security notes

Prerequisites

Set up RBAC

Generate a kubeconfig for the service account

Register the cluster

What gets synced

Multi-cluster support

Security notes