Skip to main content
Connect a Kubernetes cluster so Myrmex can inspect your workloads, review RBAC, audit cluster hardening, and help you troubleshoot. Myrmex reaches the cluster’s API server through a Collector using a service account token — everything is read in real time, on demand, and nothing from your cluster is stored on the Myrmex side.

​
What Myrmex Can Do

Inspect workloads

List and describe pods, deployments, services, and nodes — read-only diagnostics.

Cluster posture

Run Security Posture hardening checks across the cluster.

RBAC review

Review roles, bindings, and service accounts for over-permissive access.

Troubleshoot & act

Investigate failing workloads and, on approval, apply manifest changes.

​
Before You Start

  • A Collector that can reach the cluster’s API server over HTTPS. See Deploying the agent.
  • A service account in the cluster with a token and a least-privilege role — the built-in view ClusterRole is enough for analysis; grant write access only for remediation.
  • The cluster’s API server URL and CA certificate.

​
Step 1 — Create the Credential in Kubernetes

1

Create a service account

Create a dedicated service account, for example kubectl create serviceaccount myrmex -n kube-system.
2

Bind a least-privilege role

Bind the built-in view ClusterRole (or a scoped Role) to the service account for read-only access. Grant a write-capable role only when you want Myrmex to remediate.
3

Create a token

Issue a token with kubectl create token myrmex -n kube-system (or read it from a bound Secret). Copy the token value.
4

Get the API server and CA

From your kubeconfig, copy the cluster server URL and the certificate-authority-data value.
Keep the service account bound to view for analysis, and only bind a write role once you want the agents to apply changes.

​
Step 2 — Add the Integration in Myrmex

From the Directory, choose Add Integration → Kubernetes, then fill in:

​
Connect

Click Connect to validate the connection and finish. The cluster then appears under Environment → Integrations, and you can start asking the AI about it in the Workspace.
Prefer least privilege: a service account bound to the view ClusterRole covers analysis, and you can rotate its token at any time.