Connector · Kubernetes
Connect Kubernetes
API server + bearer OR mTLS. Works for any conformant cluster — GKE, EKS, AKS, vanilla, Rancher.
Permission scope
- verbs: get, list, watch on core/, apps/, batch/. The recon loop lives here.
- verbs: create, patch, delete on rollout status / scale subresources (NOT pods directly).
- Optional: read secrets, configmaps, ingresses — scoped by your RBAC.
- ClusterRole + ClusterRoleBinding OR namespaced Role + RoleBinding — pick the smaller blast radius that still covers your sprinkles.
- Yarrow never requests cluster-admin.
What Yarrow asks for
These are the exact fields the live connector setup flow accepts for Kubernetes. Anything you prepare here matches what you provide there.
| Field | Required | Note |
|---|---|---|
| label | required | Short workspace identifier. e.g. prod-eks. |
| apiServer | required | The cluster API URL. Must start with https://. e.g. https://api.example.com. |
| bearerToken | optional | Service-account JWT. Use EITHER this OR client cert + key (CA optional). |
| clientCert | optional | Client certificate in PEM. Required only when not using a bearer token. |
| clientKey | optional | Client private key in PEM. Required only when not using a bearer token. |
| caCert | optional | Cluster CA certificate in PEM. Use when the API server uses a private CA. |
Steps
- 1
Create a ServiceAccount in your cluster
Standard kubectl: `kubectl create serviceaccount yarrow-operator -n yarrow-system` and apply a RoleBinding / ClusterRoleBinding with the scope above. EKS/GKE/AKS can do this in their respective UIs.
- 2
Mint a token (bearer path)
Kubernetes 1.24+: `kubectl create token yarrow-operator -n yarrow-system --duration=8760h`. Copy the token string.
- 3
Or export an mTLS cert (mTLS path)
Generate a client cert signed by the cluster CA (or your own internal CA) and convert to PEM. Keep both halves together for the connector setup flow.
- 4
Open the workspace connector roster
/workspaces/<slug>/connectors → choose the Kubernetes setup guide.
- 5
Prepare label, API server URL, then EITHER bearer OR cert+key
The connector setup requires either a bearer token or both a client cert + key. CA cert is independent.
- 6
Return to the roster to review status
Once the connection is configured, Yarrow runs `kubectl auth whoami` semantically — a `/apis` GET against the supplied API server. A green card confirms authenticated read scope. A red card shows the API server error verbatim.
Verify
After the Kubernetes connection is configured, Yarrow runs a reachability probe: one minimal permissions call against the cloud, then stores the encrypted bundle under the chosen label. A green card confirms the probe passed. A red card shows the cloud's error verbatim — rotate keys, fix the IAM policy, and try again.
Failed probes still save the bundle so you can inspect and rotate without re-pasting.