Prerequisites
- A Relay deployed in the cluster and connected to OpenCluster.
- Relay service-account access to the namespaces and resources you intend to read.
- The Admin role in OpenCluster.
Access and trust boundary
The Relay connects outbound. Its service account is the maximum access boundary. The Integration’s comma-separated namespace allow-list can narrow that access and can never widen it. OpenCluster requests only the bounded read operations supported by both this deployment and the connected Relay. The model chooses relevant reads from the available tools. An alert’s namespace or workload name does not automatically trigger reads against every Kubernetes Integration. Do not grant create, update, patch, delete, or Kubernetes Secret-data access. Inventory synchronization records identifiers, image references, quantities, versions, and hashes; it does not copy ConfigMap data, Secret data, or environment values.Tools and required permissions
The Relay may enforce lower local ceilings. Results report the effective limits so a local cap
cannot look like a complete read. Typed not-found and unavailable outcomes remain absence or
failure states; they are never rewritten as evidence that nothing exists.
Connect
1
Create the integration
In Integrations, choose Kubernetes, enter a name, and select the Relay for the
cluster.
2
Set the namespace boundary
Optionally enter a comma-separated namespace allow-list. Leave it empty to use every
namespace reachable by the Relay service account.
3
Verify the Relay
Select Verify. A
verified result means the Relay is connected. Only reads whose
capability grants were verified are offered.Verify
Individual Tool availability names any missing Relay capability after Verification. Run one read during an Investigation and confirm its Integration, namespace, source read time, effective bounds, and truncation status.During investigations
Each enabled, currently verified Kubernetes Integration is offered as its own Source. Two clusters using the same Integration Type remain distinct and independently reachable. Every Tool call records the Integration, arguments, actual time window, truncation, safe summary, and source references. If an investigation stops waiting, OpenCluster cancels a read that has not started and asks the Relay to stop a read already in progress. The recorded outcome remains available for troubleshooting.Limitations
The Integration can read only the closed capabilities supported by both the control plane and the connected Relay. Kubernetes retention, RBAC, namespace boundaries, and the Relay’s local ceilings can make a result incomplete. OpenCluster does not read Secret data or perform write operations.Troubleshooting
- Relay is not connected: check the Relay process, outbound network path, and OpenCluster endpoint.
- A supported read operation is missing: check the Relay version and Kubernetes RBAC, then verify again.
- A read is unavailable: verify the integration and confirm the Relay supports that operation.
- Namespace is refused: add it to the Integration allow-list or use a namespace already allowed; the list cannot grant service-account access.
- A read is truncated: narrow the namespace, workload, container, or Investigation window.