Skip to content

Kubernetes integration

Connect DXDT to your Kubernetes API server for read-only cluster diagnosis: namespaces, nodes and node pressure, pod health and restarts, pod logs, events, deployments and rollout state, services, and a topology view for the DXDT graph. DXDT performs no cluster mutation — it only reads via a view-only ServiceAccount.
Setup time ~10 minutes
Difficulty Moderate

Access required: The cluster's API server URL, the CA certificate, and a bearer token for a read-only ServiceAccount bound to a view-only ClusterRole (such as the built-in view).

Prerequisites

  • kubectl access to the cluster with permission to create a ServiceAccount and ClusterRoleBinding.
  • The API server URL (from kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}').
  • The cluster CA certificate (PEM).

Setup

1. Create a read-only ServiceAccount and bind view RBAC

Create a dedicated ServiceAccount and bind it to the built-in cluster-wide view ClusterRole, which grants read-only access and (importantly) excludes secrets. Example: kubectl -n kube-system create serviceaccount dxdt-readonly then kubectl create clusterrolebinding dxdt-readonly-view --clusterrole=view --serviceaccount=kube-system:dxdt-readonly.

Note

Use view (not edit/admin). If you need pod logs cluster-wide and your view role omits them, add a minimal read-only ClusterRole granting get on pods/log rather than escalating to a broader role.

2. Obtain the ServiceAccount bearer token

Mint a token for the ServiceAccount: kubectl -n kube-system create token dxdt-readonly --duration=8760h. Copy the token — this becomes bearer_token. Plan to rotate before it expires.

  • On older clusters without the TokenRequest API, read the token from the ServiceAccount's auto-created Secret instead.
  • Store the token in a secret manager; treat it as sensitive.

3. Collect the API server URL and CA certificate

Get the API server URL (e.g. https://10.0.0.1:6443 or your managed control-plane endpoint) for api_server. Export the cluster CA certificate in PEM form for ca_cert so DXDT can verify TLS to the control plane.

4. Enter the configuration in DXDT

In the DXDT marketplace, open the Kubernetes plugin. Enter api_server, paste the bearer_token and ca_cert, and optionally set a friendly cluster_name and a default_namespace for commands that omit one. Save to install.

Configuration fields

Field Where to find it
API Server URL (api_server) Kubernetes API server / control-plane endpoint, e.g. https://10.0.0.1:6443. Required.
Bearer Token (bearer_token) ServiceAccount token for the read-only dxdt-readonly account bound to the view ClusterRole. Required. Sent as a Bearer token.
CA Certificate (ca_cert) Cluster CA certificate (PEM) used to verify TLS to the API server. Required for trusted TLS.
Cluster Name (cluster_name) Optional — friendly label to identify this cluster in DXDT. Purely cosmetic.
Default Namespace (default_namespace) Optional — namespace used by commands that don't specify one (e.g. default). Leave blank to fall back to the plugin default.

Verify the connection

On save, DXDT calls ping, which returns the API server version and confirms connectivity + token validity. You can then ask DXDT to list namespaces or list nodes to confirm read visibility.

Security

DXDT is strictly read-only against the Kubernetes API — no create, update, delete, or exec. Bind its ServiceAccount to the built-in view ClusterRole (which excludes secrets) and never to edit, admin, or cluster-admin. Scope any additional grants (e.g. pods/log) to read verbs only, and rotate the token periodically.

Troubleshooting

401 Unauthorized on ping

The bearer_token is invalid, expired, or belongs to a deleted ServiceAccount. Re-mint the token with kubectl create token dxdt-readonly and update bearer_token.

403 Forbidden on list commands

The ServiceAccount is not bound to a role granting read access to those resources. Confirm the ClusterRoleBinding to the view ClusterRole exists and targets kube-system:dxdt-readonly.

TLS verification failed / x509 errors

The ca_cert is missing, truncated, or does not match the API server's serving certificate. Re-export the full cluster CA certificate in PEM form and paste it into ca_cert.

Logs command returns 403 while other reads work

The bound role omits get on pods/log. Add a minimal read-only ClusterRole granting get on pods/log and bind it to the ServiceAccount.

Vendor documentation: https://kubernetes.io/docs/reference/access-authn-authz/rbac/