> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubernetes

> Connect a Kubernetes cluster to Myrmex — inspect workloads on demand, audit posture, and troubleshoot.

import { Note, Steps, Step, CardGroup, Card, Tip } from '@mintlify/components';

Connect a **Kubernetes** cluster so Myrmex can inspect your workloads, review RBAC, audit cluster hardening, and help you troubleshoot. Myrmex reaches the cluster's API server through a [Collector](/documentation/agent-endpoint-security/collector-mode) using a service account token — everything is read in real time, on demand, and nothing from your cluster is stored on the Myrmex side.

## What Myrmex Can Do

<CardGroup cols={2}>
  <Card title="Inspect workloads" icon="cubes">
    List and describe pods, deployments, services, and nodes — read-only diagnostics.
  </Card>

  <Card title="Cluster posture" icon="shield-halved">
    Run [Security Posture](/documentation/security-posture/overview) hardening checks across the cluster.
  </Card>

  <Card title="RBAC review" icon="user-shield">
    Review roles, bindings, and service accounts for over-permissive access.
  </Card>

  <Card title="Troubleshoot & act" icon="wrench">
    Investigate failing workloads and, on approval, apply manifest changes.
  </Card>
</CardGroup>

## Before You Start

* A **Collector** that can reach the cluster's API server over HTTPS. See [Deploying the agent](/documentation/agent-endpoint-security/installation).
* A **service account** in the cluster with a token and a least-privilege role — the built-in `view` ClusterRole is enough for analysis; grant write access only for remediation.
* The cluster's **API server URL** and **CA certificate**.

## Step 1 — Create the Credential in Kubernetes

<Steps>
  <Step title="Create a service account">
    Create a dedicated service account, for example `kubectl create serviceaccount myrmex -n kube-system`.
  </Step>

  <Step title="Bind a least-privilege role">
    Bind the built-in `view` ClusterRole (or a scoped Role) to the service account for read-only access. Grant a write-capable role only when you want Myrmex to remediate.
  </Step>

  <Step title="Create a token">
    Issue a token with `kubectl create token myrmex -n kube-system` (or read it from a bound Secret). Copy the token value.
  </Step>

  <Step title="Get the API server and CA">
    From your kubeconfig, copy the cluster `server` URL and the `certificate-authority-data` value.
  </Step>
</Steps>

<Tip>
  Keep the service account bound to `view` for analysis, and only bind a write role once you want the agents to apply changes.
</Tip>

## Step 2 — Add the Integration in Myrmex

From the **Directory**, choose **Add Integration → Kubernetes**, then fill in:

| Field                          | Description                                                                                            |
| ------------------------------ | ------------------------------------------------------------------------------------------------------ |
| **API Server**                 | The cluster API server URL the Collector can reach.                                                    |
| **Token**                      | The service account token created in Step 1. Stored securely and never exposed to the AI.              |
| **Certificate Authority Data** | The cluster's base64-encoded CA certificate.                                                           |
| **Context Name**               | A name to identify this cluster or context in Myrmex.                                                  |
| **Namespace**                  | The default namespace to scope operations to.                                                          |
| **Collector**                  | The [Collector](/documentation/agent-endpoint-security/collector-mode) that will reach the API server. |

## Connect

Click **Connect** to validate the connection and finish. The cluster then appears under **Environment → Integrations**, and you can start asking the AI about it in the Workspace.

<Note>
  Prefer least privilege: a service account bound to the `view` ClusterRole covers analysis, and you can rotate its token at any time.
</Note>