> ## Documentation Index
> Fetch the complete documentation index at: /docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubernetes

> Read pod logs, events, and pod status directly from your cluster.

Go to **Connections**, click **Connect** next to Kubernetes, and choose **ServiceAccount token** (recommended) or paste a **kubeconfig** with static credentials.

## What Ordyn reads

Pod logs, Kubernetes events such as restarts and OOM kills, and pod status by namespace.

## Permissions

The ServiceAccount token needs get, list and watch on pods, pods/log, namespaces and events, plus get and list on pod metrics (metrics.k8s.io) for pod CPU and memory. The setup command grants both.

### Pods, logs and events

Read pod logs, Kubernetes events such as restarts and OOM kills, and pod status by namespace.

Granted by: `ClusterRole log-reader`.

| Resource | Used for |
| - | - |
| `pods` | get, list, watch |
| `pods/log` | get, list, watch |
| `namespaces` | get, list, watch |
| `events` | get, list, watch |

### Pod metrics

Read pod CPU and memory from the metrics API. Only needed if you want pod metrics; without it, they show as unavailable.

| Resource | Used for |
| - | - |
| **pods in the metrics.k8s.io API group** (`metrics.k8s.io/pods`) | get, list |

### How to grant

> **Create a read-only ServiceAccount**
>
> ```bash theme={null}
> kubectl create serviceaccount log-reader -n default
>
> kubectl apply -f - <<'YAML'
> apiVersion: rbac.authorization.k8s.io/v1
> kind: ClusterRole
> metadata:
>   name: log-reader
> rules:
>   - apiGroups: [""]
>     resources: ["pods", "pods/log", "namespaces", "events"]
>     verbs: ["get", "list", "watch"]
>   - apiGroups: ["metrics.k8s.io"]
>     resources: ["pods"]
>     verbs: ["get", "list"]
> ---
> apiVersion: rbac.authorization.k8s.io/v1
> kind: ClusterRoleBinding
> metadata:
>   name: log-reader-binding
> subjects:
>   - kind: ServiceAccount
>     name: log-reader
>     namespace: default
> roleRef:
>   kind: ClusterRole
>   name: log-reader
>   apiGroup: rbac.authorization.k8s.io
> YAML
>
> kubectl apply -f - <<'YAML'
> apiVersion: v1
> kind: Secret
> metadata:
>   name: log-reader-token
>   namespace: default
>   annotations:
>     kubernetes.io/service-account.name: log-reader
> type: kubernetes.io/service-account-token
> YAML
>
> # The token to paste into Ordyn
> kubectl get secret log-reader-token -n default -o jsonpath='{.data.token}' | base64 -d
> ```

Permission catalog version `2026-10-16.1`. See [permission changes](/reference/permission-changes).

## ServiceAccount token setup

This works on every cluster, including GKE Autopilot, EKS, and AKS. The token does not expire. Run the commands under **How to grant** above, then find the API server URL:

```bash theme={null}
kubectl cluster-info | grep "control plane"
```

If your cluster uses a self-signed CA, also paste the CA certificate:

```bash theme={null}
kubectl config view --raw -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' | base64 -d
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.