Heplon

Connect Kubernetes

This guide covers what to put into the connector form for a Kubernetes cluster.

1. Create a read-only service account

Apply the manifests below. They bind the built-in view role, which covers standard troubleshooting (pods, pod logs, events, deployments, services, and more) and any custom resources that have the rbac.authorization.k8s.io/aggregate-to-view label. They also add some cluster-scoped resources view leaves out.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: heplon-reader
  namespace: kube-system
---
apiVersion: v1
kind: Secret
metadata:
  name: heplon-reader-token
  namespace: kube-system
  annotations:
    kubernetes.io/service-account.name: heplon-reader
type: kubernetes.io/service-account-token
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: heplon-reader-view
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: view
subjects:
  - kind: ServiceAccount
    name: heplon-reader
    namespace: kube-system
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: heplon-reader-cluster
rules:
  - apiGroups: ['']
    resources: ['nodes', 'nodes/status', 'persistentvolumes']
    verbs: ['get', 'list']
  - apiGroups: ['storage.k8s.io']
    resources: ['storageclasses']
    verbs: ['get', 'list']
  - apiGroups: ['metrics.k8s.io']
    resources: ['nodes', 'pods']
    verbs: ['get', 'list']
  - apiGroups: ['argoproj.io']
    resources: ['applications']
    verbs: ['get', 'list']
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: heplon-reader-cluster
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: heplon-reader-cluster
subjects:
  - kind: ServiceAccount
    name: heplon-reader
    namespace: kube-system

2. Print three values

# API URL
kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}'

# Bearer token
kubectl -n kube-system get secret heplon-reader-token \
  -o jsonpath='{.data.token}' | base64 -d

# CA certificate
kubectl config view --raw --minify \
  -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' | base64 -d

3. Fill in the form

In Heplon, open Connectors, select Add connector, then Kubernetes. Enter an arbitrary name and the three values. The cluster is now connected to Heplon.

Notes

  • The Heplon server must be able to reach the API URL.
  • k3s, kind, EKS, AKS, and GKE all sign their own API server certificate, so the system trust store cannot verify it. Leave the certificate field blank only for a publicly trusted certificate.
  • view picks up custom resources automatically when the operator that installs them labels its own view role with aggregate-to-view. Many do. Argo CD does not, which is why it has its own rule above.