# Kubernetes Clusters

Source: https://docs.ops0.com/docs/kubernetes/clusters

Monitor connected Kubernetes clusters, view workloads, and access pod terminals from a unified dashboard.

## Supported Providers

AWS EKS

Amazon Elastic Kubernetes Service

Google GKE

Google Kubernetes Engine

Azure AKS

Azure Kubernetes Service

Self-Managed

Any cluster with kubeconfig access

## Clusters List Layout

The Kubernetes section has three top-level tabs:

| Tab | Content |
|-----|---------|
| **Clusters** | All connected clusters with health, metrics, and quick actions |
| **Cost Analysis** | Org-wide cost breakdown across all clusters (requires OpenCost) |
| **Security** | Org-wide vulnerability summary across all clusters (requires Trivy) |

### Filtering and Searching

The Clusters tab has a **search box** (filter by cluster name) and a **provider dropdown** (filter by EKS / GKE / AKS / OKE / Self-managed). Use these together to quickly find a cluster in large environments.

---

## Cluster Card

Each connected cluster displays:

| Field | Description |
|-------|-------------|
| **Name** | Display name you assigned |
| **Provider** | EKS, GKE, AKS, OKE, or Self-managed |
| **Status** | Connection state (color-coded — see below) |
| **Version** | Kubernetes version (e.g., 1.28.2) |
| **Nodes** | Total node count |
| **Pods** | Running pod count |
| **Namespaces** | Namespace count |
| **Open Incidents** | Count of open incidents with severity breakdown |
| **Vulnerabilities** | CVE counts by severity (Critical / High / Medium / Low) — shown when Trivy is installed |

## Connection Status

| Status | Color | Meaning |
|--------|-------|---------|
| **Connected** | Green | Active connection via ops0 agent or direct |
| **Disconnected** | Red | Cannot reach cluster API |
| **Error** | Red | Authentication or network error |
| **Pending** | Yellow | Connection in progress |

## Cluster Detail Tabs

Overview

Cluster info, resource summary, CPU/memory usage

Incidents

Auto-detected issues (CrashLoop, OOM, etc.)

Resource Graph

Visual map of deployments, services, pods

Pods

Pod list with logs, terminal, events access

## Resource Summary

The Overview tab shows real-time metrics:

```
Nodes:       12 (12 Ready)
Namespaces:  8
Pods:        156 (150 Running, 4 Pending, 2 Failed)
Services:    42
Deployments: 35
```

Resource utilization bars display CPU and memory usage against cluster capacity.

## Cluster Actions

| Action | Description |
|--------|-------------|
| **View Details** | Open cluster detail page |
| **Test Connection** | Verify API connectivity |
| **Refresh Stats** | Fetch latest metrics |
| **Edit** | Update name or settings |
| **Delete** | Remove cluster from ops0 |
| **Enable / Disable OpenCost** | Install or uninstall OpenCost for cost analysis |
| **Enable / Disable Trivy** | Install or uninstall Trivy for vulnerability scanning |
| **Enable / Disable Kyverno** | Install or uninstall Kyverno for policy enforcement |

### Tool Installation Dialogs

Clicking **Enable OpenCost**, **Enable Trivy**, or **Enable Kyverno** opens a confirmation dialog before installation begins. The dialog shows:
- What will be installed (namespace, Helm chart)
- Estimated time to complete
- A **Confirm** button to proceed

Similarly, clicking **Disable** for any tool shows a confirmation dialog warning that data (cost history, vulnerability reports, deployed policies) will be removed when the tool is uninstalled.

## Prerequisites by Provider

AWS EKS

AWS Integration configured with `eks:DescribeCluster` and `eks:ListClusters` permissions, plus Kubernetes RBAC.

Google GKE

GCP service account with `roles/container.clusterViewer` and `roles/container.developer` for exec access.

Azure AKS

Service principal with AKS access and Azure AD tenant configuration.

Self-Managed

Valid kubeconfig with API server network access and appropriate RBAC permissions.

ops0 agent Recommended

For real-time log streaming, pod exec, and metrics collection, install the ops0 agent in your cluster. See [Add Cluster](https://docs.ops0.com/docs/kubernetes/add-cluster) for installation instructions.

---

## Multi-Cloud Cluster Discovery

Automatically discover Kubernetes clusters in your cloud accounts.

### AWS EKS Discovery

Discover all EKS clusters in your AWS account:

1. Navigate to Kubernetes → Add Cluster
2. Select "Discover EKS Clusters"
3. Choose AWS integration
4. Select regions to scan
5. View discovered clusters
6. Click "Connect" on clusters to add

**Required Permissions**:
- `eks:ListClusters`
- `eks:DescribeCluster`

**Discovery Results**:

| Cluster Name | Region | Version | Status | Action |
|--------------|--------|---------|--------|--------|
| production-eks | us-east-1 | 1.28 | Active | Connect |
| staging-eks | us-east-1 | 1.28 | Active | Connect |
| dev-eks | us-west-2 | 1.27 | Active | Connect |

### Google GKE Discovery

Discover all GKE clusters in your GCP project:

1. Navigate to Kubernetes → Add Cluster
2. Select "Discover GKE Clusters"
3. Choose GCP project
4. View discovered clusters
5. Click "Connect" on clusters to add

**Required Permissions**:
- `container.clusters.list`
- `container.clusters.get`

### Azure AKS Discovery

Discover all AKS clusters in your Azure subscription:

1. Navigate to Kubernetes → Add Cluster
2. Select "Discover AKS Clusters"
3. Choose Azure subscription
4. Select resource groups (or all)
5. View discovered clusters
6. Click "Connect" on clusters to add

**Required Permissions**:
- `Microsoft.ContainerService/managedClusters/read`
- `Microsoft.ContainerService/managedClusters/listClusterUserCredential/action`

### Token Refresh

Cloud provider tokens expire and need periodic refresh:

**EKS Tokens**:
- Expire after 15 minutes
- Auto-refreshed by ops0 before expiration
- Uses AWS STS presigned URLs

**GKE Tokens**:
- Expire after 1 hour
- Auto-refreshed using OAuth2 refresh tokens
- Service account must remain valid

**AKS Tokens**:
- Expire after 1 hour
- Auto-refreshed using Azure OAuth2
- Service principal must remain valid

**If Token Refresh Fails**:
- Cluster shows "Disconnected" status
- Check cloud integration credentials
- Verify IAM permissions
- Re-authenticate integration if needed

---

## Example: Production Cluster Overview

### Cluster List View

| Name | Provider | Status | Version | Nodes | Pods | Incidents |
|------|----------|--------|---------|-------|------|-----------|
| production-eks | AWS EKS | Connected | 1.28.2 | 12 | 156 | 2 open |
| staging-eks | AWS EKS | Connected | 1.28.2 | 4 | 42 | - |
| dev-cluster | GKE | Connected | 1.27.8 | 2 | 18 | - |
| on-prem-k8s | Self-managed | Disconnected | 1.26.5 | 6 | 0 | - |

### Cluster Detail: production-eks

**Overview Tab:**

```
Cluster Information
─────────────────────────────────────
Name:           production-eks
Provider:       AWS EKS
Region:         us-east-1
Version:        1.28.2
Created:        2023-06-15
ops0 agent:     v2.1.0 (Connected)

Resource Summary
─────────────────────────────────────
Nodes:          12 (12 Ready)
Namespaces:     8
Pods:           156 (150 Running, 4 Pending, 2 Failed)
Services:       42
Deployments:    35
StatefulSets:   4
DaemonSets:     6

Resource Utilization
─────────────────────────────────────
CPU:    ████████████████░░░░ 78%   (93.6 / 120 cores)
Memory: ██████████████░░░░░░ 68%   (326 / 480 GB)
```

**Node List:**

| Node | Status | CPU | Memory | Pods | Age |
|------|--------|-----|--------|------|-----|
| ip-10-0-1-45.ec2.internal | Ready | 82% | 71% | 18/30 | 45d |
| ip-10-0-1-78.ec2.internal | Ready | 75% | 68% | 15/30 | 45d |
| ip-10-0-2-12.ec2.internal | Ready | 89% | 82% | 22/30 | 30d |
| ip-10-0-2-34.ec2.internal | Ready | 65% | 55% | 12/30 | 30d |

### Resource Graph

```
Deployment: api-gateway (3 replicas)
    │
    ├─ ReplicaSet: api-gateway-7d9f8c6b4d
    │      │
    │      ├─ Pod: api-gateway-7d9f8c6b4d-2xkjp (Running)
    │      ├─ Pod: api-gateway-7d9f8c6b4d-9vwrt (Running)
    │      └─ Pod: api-gateway-7d9f8c6b4d-kp3mn (Running)
    │
    └─ Service: api-gateway (ClusterIP:80 → 3000)
           │
           └─ Ingress: api-gateway-ingress (api.example.com)
```