> ## Documentation Index
> Fetch the complete documentation index at: https://docs.steadwing.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubernetes

> Steadwing connects to your Kubernetes clusters to monitor pod health, resource utilization, deployment states, and cluster events for AI-powered incident analysis.

## What does the Kubernetes integration do?

Steadwing connects to your Kubernetes clusters to access pod status, container logs, and cluster events during incident analysis. Steadwing analyzes pod health, resource utilization, and deployment states to identify infrastructure-related issues that correlate with production incidents.

## Why Use Kubernetes with Steadwing?

<CardGroup cols={2}>
  <Card title="Pod Monitoring" icon="boxes">
    Track pod status, restarts, and failures during incidents
  </Card>

  <Card title="Log Analysis" icon="file-text">
    Access and analyze pod logs to identify error patterns
  </Card>

  <Card title="Resource Tracking" icon="gauge">
    Monitor cluster resource usage and capacity issues
  </Card>

  <Card title="Event Correlation" icon="calendar-clock">
    Connect Kubernetes events to incident timing for better context
  </Card>
</CardGroup>

## How do I connect Kubernetes to Steadwing?

Choose your platform and copy-paste the complete command block:

<Tabs>
  <Tab title="AWS EKS">
    ```bash theme={null}
    # 1. Connect to your EKS cluster (replace with your values)
    aws eks update-kubeconfig --name YOUR_CLUSTER_NAME --region YOUR_REGION

    # 2. Create read-only service account and permissions
    kubectl apply -f - <<EOF
    apiVersion: v1
    kind: Namespace
    metadata:
      name: steadwing
    ---
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: steadwing-readonly
      namespace: steadwing
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRole
    metadata:
      name: steadwing-readonly
    rules:
      # Read access
      - apiGroups: [""]
        resources: ["pods", "pods/log", "events", "nodes", "namespaces", "services", "endpoints"]
        verbs: ["get", "list"]
      - apiGroups: ["apps"]
        resources: ["deployments", "replicasets", "statefulsets", "daemonsets"]
        verbs: ["get", "list"]
      - apiGroups: ["batch"]
        resources: ["jobs", "cronjobs"]
        verbs: ["get", "list"]
      # Write access for automated remediation
      - apiGroups: ["apps"]
        resources: ["deployments", "statefulsets", "daemonsets", "replicasets"]
        verbs: ["patch", "update"]
      - apiGroups: ["apps"]
        resources: ["deployments/scale", "statefulsets/scale", "replicasets/scale"]
        verbs: ["patch", "update"]
      - apiGroups: [""]
        resources: ["pods"]
        verbs: ["create", "delete"]
      - apiGroups: [""]
        resources: ["pods/exec"]
        verbs: ["create"]
      - apiGroups: [""]
        resources: ["configmaps", "secrets", "services"]
        verbs: ["create", "update", "patch"]
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      name: steadwing-readonly-binding
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: steadwing-readonly
    subjects:
      - kind: ServiceAccount
        name: steadwing-readonly
        namespace: steadwing
    EOF

    # 3. Generate the kubeconfig file
    sleep 3
    CLUSTER_NAME=$(kubectl config view --minify -o jsonpath='{.clusters[0].name}')
    CLUSTER_SERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
    CLUSTER_CA=$(kubectl config view --minify --raw -o jsonpath='{.clusters[0].cluster.certificate-authority-data}')
    TOKEN=$(kubectl create token steadwing-readonly -n steadwing --duration=87600h)

    cat > steadwing-kubeconfig.yaml <<EOF
    apiVersion: v1
    kind: Config
    clusters:
    - cluster:
        certificate-authority-data: ${CLUSTER_CA}
        server: ${CLUSTER_SERVER}
      name: ${CLUSTER_NAME}
    contexts:
    - context:
        cluster: ${CLUSTER_NAME}
        namespace: default
        user: steadwing-readonly
      name: steadwing-readonly@${CLUSTER_NAME}
    current-context: steadwing-readonly@${CLUSTER_NAME}
    users:
    - name: steadwing-readonly
      user:
        token: ${TOKEN}
    EOF

    echo "Done! Your kubeconfig file is ready: steadwing-kubeconfig.yaml"
    cat steadwing-kubeconfig.yaml
    ```

    **Next:** Copy the entire output and upload it to Steadwing, or upload the `steadwing-kubeconfig.yaml` file.
  </Tab>

  <Tab title="Google GKE">
    ```bash theme={null}
    # 1. Connect to your GKE cluster (replace with your values)
    gcloud container clusters get-credentials YOUR_CLUSTER_NAME --region YOUR_REGION --project YOUR_PROJECT_ID

    # 2. Create read-only service account and permissions
    kubectl apply -f - <<EOF
    apiVersion: v1
    kind: Namespace
    metadata:
      name: steadwing
    ---
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: steadwing-readonly
      namespace: steadwing
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRole
    metadata:
      name: steadwing-readonly
    rules:
      # Read access
      - apiGroups: [""]
        resources: ["pods", "pods/log", "events", "nodes", "namespaces", "services", "endpoints"]
        verbs: ["get", "list"]
      - apiGroups: ["apps"]
        resources: ["deployments", "replicasets", "statefulsets", "daemonsets"]
        verbs: ["get", "list"]
      - apiGroups: ["batch"]
        resources: ["jobs", "cronjobs"]
        verbs: ["get", "list"]
      # Write access for automated remediation
      - apiGroups: ["apps"]
        resources: ["deployments", "statefulsets", "daemonsets", "replicasets"]
        verbs: ["patch", "update"]
      - apiGroups: ["apps"]
        resources: ["deployments/scale", "statefulsets/scale", "replicasets/scale"]
        verbs: ["patch", "update"]
      - apiGroups: [""]
        resources: ["pods"]
        verbs: ["create", "delete"]
      - apiGroups: [""]
        resources: ["pods/exec"]
        verbs: ["create"]
      - apiGroups: [""]
        resources: ["configmaps", "secrets", "services"]
        verbs: ["create", "update", "patch"]
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      name: steadwing-readonly-binding
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: steadwing-readonly
    subjects:
      - kind: ServiceAccount
        name: steadwing-readonly
        namespace: steadwing
    EOF

    # 3. Generate the kubeconfig file
    sleep 3
    CLUSTER_NAME=$(kubectl config view --minify -o jsonpath='{.clusters[0].name}')
    CLUSTER_SERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
    CLUSTER_CA=$(kubectl config view --minify --raw -o jsonpath='{.clusters[0].cluster.certificate-authority-data}')
    TOKEN=$(kubectl create token steadwing-readonly -n steadwing --duration=87600h)

    cat > steadwing-kubeconfig.yaml <<EOF
    apiVersion: v1
    kind: Config
    clusters:
    - cluster:
        certificate-authority-data: ${CLUSTER_CA}
        server: ${CLUSTER_SERVER}
      name: ${CLUSTER_NAME}
    contexts:
    - context:
        cluster: ${CLUSTER_NAME}
        namespace: default
        user: steadwing-readonly
      name: steadwing-readonly@${CLUSTER_NAME}
    current-context: steadwing-readonly@${CLUSTER_NAME}
    users:
    - name: steadwing-readonly
      user:
        token: ${TOKEN}
    EOF

    echo "Done! Your kubeconfig file is ready: steadwing-kubeconfig.yaml"
    cat steadwing-kubeconfig.yaml
    ```

    **Next:** Copy the entire output and upload it to Steadwing, or upload the `steadwing-kubeconfig.yaml` file.
  </Tab>

  <Tab title="Azure AKS">
    ```bash theme={null}
    # 1. Connect to your AKS cluster (replace with your values)
    az aks get-credentials --resource-group YOUR_RESOURCE_GROUP --name YOUR_CLUSTER_NAME

    # 2. Create read-only service account and permissions
    kubectl apply -f - <<EOF
    apiVersion: v1
    kind: Namespace
    metadata:
      name: steadwing
    ---
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: steadwing-readonly
      namespace: steadwing
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRole
    metadata:
      name: steadwing-readonly
    rules:
      # Read access
      - apiGroups: [""]
        resources: ["pods", "pods/log", "events", "nodes", "namespaces", "services", "endpoints"]
        verbs: ["get", "list"]
      - apiGroups: ["apps"]
        resources: ["deployments", "replicasets", "statefulsets", "daemonsets"]
        verbs: ["get", "list"]
      - apiGroups: ["batch"]
        resources: ["jobs", "cronjobs"]
        verbs: ["get", "list"]
      # Write access for automated remediation
      - apiGroups: ["apps"]
        resources: ["deployments", "statefulsets", "daemonsets", "replicasets"]
        verbs: ["patch", "update"]
      - apiGroups: ["apps"]
        resources: ["deployments/scale", "statefulsets/scale", "replicasets/scale"]
        verbs: ["patch", "update"]
      - apiGroups: [""]
        resources: ["pods"]
        verbs: ["create", "delete"]
      - apiGroups: [""]
        resources: ["pods/exec"]
        verbs: ["create"]
      - apiGroups: [""]
        resources: ["configmaps", "secrets", "services"]
        verbs: ["create", "update", "patch"]
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      name: steadwing-readonly-binding
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: steadwing-readonly
    subjects:
      - kind: ServiceAccount
        name: steadwing-readonly
        namespace: steadwing
    EOF

    # 3. Generate the kubeconfig file
    sleep 3
    CLUSTER_NAME=$(kubectl config view --minify -o jsonpath='{.clusters[0].name}')
    CLUSTER_SERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
    CLUSTER_CA=$(kubectl config view --minify --raw -o jsonpath='{.clusters[0].cluster.certificate-authority-data}')
    TOKEN=$(kubectl create token steadwing-readonly -n steadwing --duration=87600h)

    cat > steadwing-kubeconfig.yaml <<EOF
    apiVersion: v1
    kind: Config
    clusters:
    - cluster:
        certificate-authority-data: ${CLUSTER_CA}
        server: ${CLUSTER_SERVER}
      name: ${CLUSTER_NAME}
    contexts:
    - context:
        cluster: ${CLUSTER_NAME}
        namespace: default
        user: steadwing-readonly
      name: steadwing-readonly@${CLUSTER_NAME}
    current-context: steadwing-readonly@${CLUSTER_NAME}
    users:
    - name: steadwing-readonly
      user:
        token: ${TOKEN}
    EOF

    echo "Done! Your kubeconfig file is ready: steadwing-kubeconfig.yaml"
    cat steadwing-kubeconfig.yaml
    ```

    **Next:** Copy the entire output and upload it to Steadwing, or upload the `steadwing-kubeconfig.yaml` file.
  </Tab>

  <Tab title="Self-Hosted">
    ```bash theme={null}
    # 1. Make sure you're connected to your cluster
    kubectl cluster-info

    # 2. Create read-only service account and permissions
    kubectl apply -f - <<EOF
    apiVersion: v1
    kind: Namespace
    metadata:
      name: steadwing
    ---
    apiVersion: v1
    kind: ServiceAccount
    metadata:
      name: steadwing-readonly
      namespace: steadwing
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRole
    metadata:
      name: steadwing-readonly
    rules:
      # Read access
      - apiGroups: [""]
        resources: ["pods", "pods/log", "events", "nodes", "namespaces", "services", "endpoints"]
        verbs: ["get", "list"]
      - apiGroups: ["apps"]
        resources: ["deployments", "replicasets", "statefulsets", "daemonsets"]
        verbs: ["get", "list"]
      - apiGroups: ["batch"]
        resources: ["jobs", "cronjobs"]
        verbs: ["get", "list"]
      # Write access for automated remediation
      - apiGroups: ["apps"]
        resources: ["deployments", "statefulsets", "daemonsets", "replicasets"]
        verbs: ["patch", "update"]
      - apiGroups: ["apps"]
        resources: ["deployments/scale", "statefulsets/scale", "replicasets/scale"]
        verbs: ["patch", "update"]
      - apiGroups: [""]
        resources: ["pods"]
        verbs: ["create", "delete"]
      - apiGroups: [""]
        resources: ["pods/exec"]
        verbs: ["create"]
      - apiGroups: [""]
        resources: ["configmaps", "secrets", "services"]
        verbs: ["create", "update", "patch"]
    ---
    apiVersion: rbac.authorization.k8s.io/v1
    kind: ClusterRoleBinding
    metadata:
      name: steadwing-readonly-binding
    roleRef:
      apiGroup: rbac.authorization.k8s.io
      kind: ClusterRole
      name: steadwing-readonly
    subjects:
      - kind: ServiceAccount
        name: steadwing-readonly
        namespace: steadwing
    EOF

    # 3. Generate the kubeconfig file
    sleep 3
    CLUSTER_NAME=$(kubectl config view --minify -o jsonpath='{.clusters[0].name}')
    CLUSTER_SERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
    CLUSTER_CA=$(kubectl config view --minify --raw -o jsonpath='{.clusters[0].cluster.certificate-authority-data}')
    TOKEN=$(kubectl create token steadwing-readonly -n steadwing --duration=87600h)

    cat > steadwing-kubeconfig.yaml <<EOF
    apiVersion: v1
    kind: Config
    clusters:
    - cluster:
        certificate-authority-data: ${CLUSTER_CA}
        server: ${CLUSTER_SERVER}
      name: ${CLUSTER_NAME}
    contexts:
    - context:
        cluster: ${CLUSTER_NAME}
        namespace: default
        user: steadwing-readonly
      name: steadwing-readonly@${CLUSTER_NAME}
    current-context: steadwing-readonly@${CLUSTER_NAME}
    users:
    - name: steadwing-readonly
      user:
        token: ${TOKEN}
    EOF

    echo "Done! Your kubeconfig file is ready: steadwing-kubeconfig.yaml"
    cat steadwing-kubeconfig.yaml
    ```

    **Next:** Copy the entire output and upload it to Steadwing, or upload the `steadwing-kubeconfig.yaml` file.
  </Tab>
</Tabs>

### Upload to Steadwing

After running the commands above:

1. **Option A:** Copy the entire YAML output from your terminal
2. **Option B:** Use the generated file `steadwing-kubeconfig.yaml`
3. Go to **Integrations** → **Kubernetes** → **Connect**
4. Upload or paste the kubeconfig content
5. Done!

## What This Creates

* Service account with read access and scoped write access for automated remediation
* Token valid for 10 years
* Read access to: pods, logs, events, deployments, jobs
* Write access to: workload scaling, pod management, configuration updates
* Isolated in `steadwing` namespace
* Works with all Kubernetes versions 1.22+

## What data does Steadwing pull from Kubernetes?

### Data Collection

Steadwing queries Kubernetes for:

* **Pod Status** - Running, pending, failed, and crashed pods
* **Pod Logs** - Container logs for error analysis
* **Events** - Cluster events related to scheduling, scaling, and failures
* **Deployments** - Deployment status and replica counts
* **Resource Usage** - Node and pod resource allocation

## What permissions does the Kubernetes integration need?

### Required Permissions

The service account has **read access** to:

* `pods`, `pods/log` - View pods and their logs
* `events` - Read cluster events
* `nodes`, `namespaces`, `services`, `endpoints` - View cluster resources
* `deployments`, `replicasets`, `statefulsets`, `daemonsets` - View workload status
* `jobs`, `cronjobs` - View batch workloads

The service account has **scoped write access** for automated remediation:

* `deployments`, `statefulsets`, `daemonsets`, `replicasets` - `patch`, `update` for workload updates
* `deployments/scale`, `statefulsets/scale`, `replicasets/scale` - `patch`, `update` for scaling operations
* `pods` - `create`, `delete` for pod management
* `pods/exec` - `create` for executing commands in pods
* `configmaps`, `secrets`, `services` - `create`, `update`, `patch` for configuration changes

### Security

* Read access for monitoring, scoped write access for automated remediation
* All write operations require explicit user approval before execution
* Token-based authentication
* Token expiration set to 1 year (renewable)

## Uninstall

To remove the Steadwing integration from your cluster:

```bash theme={null}
kubectl delete namespace steadwing
kubectl delete clusterrole steadwing-readonly
kubectl delete clusterrolebinding steadwing-readonly-binding
```

## FAQs

<AccordionGroup>
  <Accordion title="What Kubernetes versions are supported?">
    The integration works with Kubernetes 1.22 and later. It's compatible with all major distributions including EKS, GKE, AKS, and self-hosted clusters.
  </Accordion>

  <Accordion title="Can Steadwing modify my cluster resources?">
    Yes, Steadwing can execute approved infrastructure changes as part of automated remediation. Supported actions include scaling deployments, restarting pods, executing commands in pods, and updating configurations. All actions require explicit user approval before execution.
  </Accordion>

  <Accordion title="How long is the service account token valid?">
    The token is generated with a 10-year (87600 hours) validity period. You'll need to regenerate it after expiration by running the setup script again.
  </Accordion>

  <Accordion title="What happens if I delete the steadwing namespace?">
    The integration will stop working. You'll need to run the setup script again to recreate the service account and generate a new kubeconfig file.
  </Accordion>

  <Accordion title="Can I use this with multiple clusters?">
    Yes! Run the setup script for each cluster. Each cluster will generate its own kubeconfig file that you can upload separately to Steadwing.
  </Accordion>

  <Accordion title="Does this work with private clusters?">
    Yes, as long as Steadwing can reach the cluster's API server endpoint. For private clusters, you may need to configure network access or use a VPN.
  </Accordion>
</AccordionGroup>

Need additional help? Please reach out to us at [hello@steadwing.com](mailto:hello@steadwing.com)