Skip to main content
The Kubernetes connector is part of the Enterprise Edition, and is currently in beta.
Bag of words talks to the Kubernetes API server directly (/api/v1/..., /apis/<group>/...). There is no query language: queries are JSON specs that map onto a catalog of virtual tables, the same shape as the Zabbix and Aria Operations connectors.

​
What the catalog looks like

Three layers of tables live on one connection, because an investigation crosses them — the pod that is CrashLoopBackOff in inventory is the one whose last log lines and OOM events explain why.

​
Security posture

The service-account token is cluster-wide read-only, which means the connector — not RBAC — is the guard against secrets. Read this before you connect a production cluster:
  • There is no secrets table.
  • The raw-path escape hatch refuses secrets, exec, attach, portforward and proxy paths.
  • configmaps exposes key names only, never values.
  • Container environment literals are redacted from raw output.
  • The kubectl.kubernetes.io/last-applied-configuration annotation is dropped everywhere, because it embeds the full spec — environment included.
RBAC has no “everything except” syntax, so the role the setup manifest creates can read Secrets with kubectl, even though the connector never does. Treat the token like a database superuser password. It is encrypted at rest, and you rotate it by deleting the token Secret.

​
Before you start

The connect form renders this as a numbered setup guide with copy buttons, so you can follow it in the product rather than from here.
1

Grant read access on the cluster

Apply the manifest shown in the connect form with cluster-admin rights. It creates the bagofwords namespace, a bagofwords-reader service account, a cluster-wide read-only ClusterRole (get, list, watch on apiGroups: ["*"] / resources: ["*"], plus get on non-resource URLs), its binding, and a long-lived service-account token Secret.One wildcard rule covers every built-in kind, every CRD group and every aggregated API (metrics-server), so the manifest does not need editing when the cluster gains an operator.
2

Print the access file

Save the print_access_file.sh script from the connect form and run it. It waits for the token to be populated, then prints one self-contained document holding the API server URL, the cluster CA and the token.Verify it before pasting:
If the server URL in the file is private to your network, edit it to the address this Bag of words instance can actually reach.
3

Paste it in and test

Paste the whole output into the Cluster access file field and click Test connection.

​
Fields

Most of these are advanced settings and stay hidden in the connect form unless you open them.

​
Authentication

Cluster access file — access_file (system scope, the only mode) There is exactly one mechanism: the bearer token of a long-lived service-account token Secret. The parser accepts only what the script produces — one cluster with server and certificate-authority-data, one user with token — and rejects exec credential plugins, client certificates and auth providers by name. Personal kubeconfigs will not work, and there is no per-user scope.

​
Troubleshooting

The script ran before the control plane populated the token Secret, or the manifest was not applied. Apply the manifest first, then re-run the script — it already retries for 30 seconds.
The server URL in the access file is the address your kubectl uses, which may be private. Edit it to an address the Bag of words backend can reach, then paste the file again.
It was a personal kubeconfig rather than the script’s output. Exec credential plugins, client certificates and auth providers are refused by design — re-run print_access_file.sh.
The cluster does not serve metrics.k8s.io. Install metrics-server and re-index the connection.
Only populated CRDs are discovered, and discovery stops at max_crd_tables (40 by default). Raise the cap, or query the resource by name — uncatalogued CRDs stay queryable.