The K8s Source plugin for CloudQuery extracts configuration from a variety of K8s APIs
Publisher
cloudquery
Latest version
v7.13.1
Type
Source
Platforms
Date Published
Loading plugin documentation
CloudQuery's use of cookies
We use tracking cookies to understand how you use the product and help us improve it. Your consent is required before we can enable these cookies. You can opt out via the link in the footer.
kubectl works, cloudquery depends on a Kubernetes configuration file to connect to a Kubernetes cluster and sync its information.
By default, cloudquery uses the default Kubernetes configuration file (~/.kube/config).
You can also specify a different configuration by setting the KUBECONFIG environment variable before running cloudquery sync.providers configuration to connect to managed Kubernetes clusters (EKS, GKE, AKS), the plugin needs to obtain credentials for each cluster's API server. For EKS and GKE this is done via exec-based authentication — the Kubernetes client-go library executes the configured binaries at runtime to fetch short-lived tokens. For AKS, the plugin fetches AAD access tokens in-process via the Azure SDK and no external binary is required on the default path.Note: The GCP binaries are expected at/usr/local/google-cloud-sdk/bin/. The AWS IAM authenticator is expected at/usr/local/bin/aws-iam-authenticator.
kubelogin binary is required on the runtime PATH. If you need to fall back to the legacy kubelogin-based authentication for any reason, set use_kubelogin: true on the Azure provider:providers:
- cluster: my-aks-cluster
azure:
subscription_id: ...
resource_group_name: ...
tenant_id: ...
client_id: ...
client_secret: ...
use_kubelogin: true # opt in to the legacy kubelogin-based path
prefer_private_endpoint to explicitly control which endpoint is used:providers:
- cluster: my-private-aks-cluster
azure:
subscription_id: ...
resource_group_name: ...
tenant_id: ...
client_id: ...
client_secret: ...
prefer_private_endpoint: true # use the private FQDN (requires VNet connectivity)
prefer_private_endpoint flag is tri-state:ServerFqdn query parameter on Azure's ListClusterUserCredentials ARM endpoint, which accepts the literal string public or private as a type selector.use_kubelogin: true is set, the kubelogin binary must be on PATH at runtime. CloudQuery does not automatically run kubelogin convert-kubeconfig or rewrite the exec arguments in the kubeconfig returned by Azure. In providers mode the kubeconfig is fetched in-process from ListClusterUserCredentials and passed directly to the Kubernetes client, so there is no on-disk kubeconfig file where you can apply convert-kubeconfig yourself.--login devicecode, which is interactive and hangs forever in headless environments (such as Kubernetes pods) waiting for a user to visit https://login.microsoft.com/device. As a result, use_kubelogin: true is only useful when either:devicecode login is acceptable (typically local development, not production), orAAD_LOGIN_METHOD=spn with AAD_SERVICE_PRINCIPAL_CLIENT_ID / AAD_SERVICE_PRINCIPAL_CLIENT_SECRET, or AAD_LOGIN_METHOD=workloadidentity with the corresponding workload identity variables). These environment variables affect every kubelogin subprocess the plugin spawns.use_kubelogin unset). It requires no external binary, cannot hang on devicecode prompts, and uses the same client_secret / oidc_token credentials already configured on the provider.FROM public.ecr.aws/eks-distro/kubernetes-sigs/aws-iam-authenticator:v0.7.9-eks-1-32-latest AS aws
FROM bitnami/google-cloud-sdk:0.536.0 AS gcloud
FROM <your-base-image>
# AWS EKS authentication
COPY --from=aws /aws-iam-authenticator /usr/local/bin/aws-iam-authenticator
# GCP GKE authentication
COPY --from=gcloud /opt/bitnami/google-cloud-sdk/ /usr/local/google-cloud-sdk
RUN /usr/local/google-cloud-sdk/bin/gcloud components install gke-gcloud-auth-plugin
export KUBECONFIG="<PATH_TO_YOUR_CONFIG_FILE>"
cloudquery is running in a pod of the Kubernetes cluster, the Kubernetes Service Account can be used for direct authentication. To use the Kubernetes Service Account for direct authentication, a cluster role with all get and list privileges will need to be used.get and list privileges.kubectl apply -f - <<EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
name: cloudquery-cluster-read
rules:
- apiGroups:
- '*'
resources:
- '*'
verbs:
- get
- list
- nonResourceURLs:
- '*'
verbs:
- get
- list
EOF
cloudquery pod.kubectl apply -f - <<EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
name: cloudquery-cluster-read-binding
subjects:
- kind: ServiceAccount
name: cloudquery-sa
roleRef:
kind: ClusterRole
name: cloudquery-cluster-read
EOF
kind: source
spec:
# Source spec section
name: k8s
path: cloudquery/k8s
registry: cloudquery
version: "v7.13.1"
tables: ["*"]
destinations: ["postgresql"]
# Learn more about the configuration options at https://cql.ink/k8s_source
spec:
contexts: ["context"]
aws-iam-authenticator to be installed (see Authentication).
The (top level) source spec section is described in the Source Spec Reference.kind: source
spec:
name: k8s
path: cloudquery/k8s
version: v7.3.8
tables:
- "*"
spec:
providers:
- cluster: eks-cluster-name
aws:
region: us-east-1
role_arn: arn:aws:iam::111111111111:role/cross-account-readonly-role
kind: source
spec:
name: k8s
path: cloudquery/k8s
version: "v7.13.1"
tables:
- "*"
spec:
providers:
- cluster: cluster-name
azure:
# service principal details:
client_id: service-pricipal-app-id
tenant_id: service-pricipal-tenant
client_secret: service-pricipal-password
# k8s cluster details:
subscription_id: subscription-id
resource_group_name: resource-group-name
# optional: use the private endpoint (requires VNet connectivity)
# prefer_private_endpoint: true
gcloud and gke-gcloud-auth-plugin to be installed (see Authentication).kind: source
spec:
name: k8s
path: cloudquery/k8s
version: "v7.13.1"
tables:
- "*"
spec:
providers:
- cluster: gcp-cluster-name
gcp:
project_id: project-id
location: us-central1
service_account_key_json: |
${SERVICE_ACCOUNT_JSON_KEY}
authenticate_gcloud: true
contexts ([]string) (optional) (default: empty)* will connect to all contexts available in the K8s config file (usually ~/.kube/config).
When providers are configured and contexts is empty, all provider clusters are used as contexts (in the order they are defined).
When providers are not configured and contexts is empty, the default context from the K8s config file is used.concurrency (integer) (optional) (default: 5000)scheduler (string) (optional) (default: dfs)
The scheduler to use when determining the priority of resources to sync.
Supported values are dfs (depth-first search), round-robin, shuffle and shuffle-queue.aws_authenticator_path (string) (optional) (default: /usr/local/bin/aws-iam-authenticator)aws-iam-authenticator binary used for EKS exec-based authentication. If the binary is not installed at the default location, override the path here.gke_auth_plugin_path (string) (optional) (default: "/usr/local/google-cloud-sdk/bin/gke-gcloud-auth-plugin")gke-gcloud-auth-plugin binary used for GKE exec-based authentication. If the plugin is installed in a different location, configure its path with this option.gcloud_path (string) (optional) (default: "/usr/local/google-cloud-sdk/bin/gcloud")gcloud binary, used when authenticate_gcloud is enabled. If gcloud is installed elsewhere, set this field to the correct path.providers ([]Provider) (optional) (default: empty.)cluster (string) (required)aws (AWSSpec) (optional)gcp (GCPSpec) (optional)azure (AzureSpec) (optional)Prerequisite: The generated kubeconfig uses exec-based authentication withaws-iam-authenticator, which must be installed at/usr/local/bin/aws-iam-authenticator. See Authentication for details.
region (string) (required)role_arn (string) (optional)external_id (string) (optional)Prerequisite: The generated kubeconfig uses exec-based authentication withgke-gcloud-auth-plugin, which must be installed at/usr/local/google-cloud-sdk/bin/. Whenauthenticate_gcloudis set totrue,gcloudis also required at the same path. See Authentication for details.
project_id (string) (required)location (string) (required)service_account_key_json (string) (required)authenticate_gcloud (bool) (optional)gcloud auth activate-service-account --key-file=<JSON_FILE>prefer_private_endpoint (bool) (optional)Note: Azure authentication is handled natively via the Azure SDK for Go. No external binaries are required.
subscription_id (string) (required)resource_group_name (string) (required)client_id (string) (required)tenant_id (string) (required)client_secret (string) (optional)oidc_token (string) (optional)client_secret.cloud_name (string) (optional)AzureCloud, AzureChinaCloud, AzureGovernment.kind: source
spec:
# Source spec section
name: k8s
path: cloudquery/k8s
registry: cloudquery
version: "v7.13.1"
tables: ["*"]
destinations: ["postgresql"]
# Learn more about the configuration options at https://cql.ink/k8s_source
spec:
contexts: ["context"]
aws-iam-authenticator to be installed (see Authentication).
The (top level) source spec section is described in the Source Spec Reference.kind: source
spec:
name: k8s
path: cloudquery/k8s
version: v7.3.8
tables:
- "*"
spec:
providers:
- cluster: eks-cluster-name
aws:
region: us-east-1
role_arn: arn:aws:iam::111111111111:role/cross-account-readonly-role
kind: source
spec:
name: k8s
path: cloudquery/k8s
version: "v7.13.1"
tables:
- "*"
spec:
providers:
- cluster: cluster-name
azure:
# service principal details:
client_id: service-pricipal-app-id
tenant_id: service-pricipal-tenant
client_secret: service-pricipal-password
# k8s cluster details:
subscription_id: subscription-id
resource_group_name: resource-group-name
# optional: use the private endpoint (requires VNet connectivity)
# prefer_private_endpoint: true
gcloud and gke-gcloud-auth-plugin to be installed (see Authentication).kind: source
spec:
name: k8s
path: cloudquery/k8s
version: "v7.13.1"
tables:
- "*"
spec:
providers:
- cluster: gcp-cluster-name
gcp:
project_id: project-id
location: us-central1
service_account_key_json: |
${SERVICE_ACCOUNT_JSON_KEY}
authenticate_gcloud: true
kind: source
spec:
name: k8s
path: cloudquery/k8s
registry: cloudquery
version: "v7.13.1-fips"
...