Register Kubernetes clusters and scan your workloads

Connect Kubernetes clusters to InfraAudit, browse deployments and pods, and run drift detection and vulnerability scans against your workloads.

InfraAudit treats Kubernetes clusters as a first-class provider type alongside AWS, GCP, and Azure. Connect a cluster to browse deployments, pods, services, and namespaces — and run drift detection and vulnerability scanning against your Kubernetes workloads.

Connecting a cluster

1. Open Cloud Providers

   In the sidebar, click Cloud Providers.

2. Choose Kubernetes

   Click Connect provider → Kubernetes.

3. Upload your kubeconfig

   Upload a kubeconfig file or paste its contents into the form. Give the cluster a display name.

4. Connect

   Click Connect. InfraAudit reads the active context in the kubeconfig and connects to that cluster.

If you have multiple clusters to register, connect each one separately.

Minimum RBAC permissions:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: infraudit-reader
rules:
  - apiGroups: ["", "apps", "batch"]
    resources:
      - deployments
      - pods
      - services
      - namespaces
      - replicasets
      - daemonsets
      - statefulsets
      - jobs
      - cronjobs
    verbs: ["get", "list", "watch"]

The service account or user in the kubeconfig should be read-only.

Via CLI:

infraudit kubernetes register --kubeconfig ~/.kube/config --name production

What InfraAudit collects

After connecting a cluster, InfraAudit syncs the following workload data:

View	What’s shown
Clusters	All registered clusters with health status and resource counts
Namespaces	Namespaces per cluster with pod counts
Deployments	Deployments across all clusters with replica status
Pods	Individual pods with status, namespace, and node assignment
Services	ClusterIP, NodePort, and LoadBalancer services

All Kubernetes resources appear in the main Resources and inventory view alongside your cloud resources, and can be filtered by cluster.

Drift detection for Kubernetes

InfraAudit detects two types of Kubernetes drift:

Baseline snapshots — InfraAudit captures a baseline of your workloads on first sync. Subsequent scans flag configuration changes including:

• Image tag changes (e.g. nginx:1.24 → nginx:latest)
• Replica count changes made outside of a deployment rollout
• Resource limits removed or modified
• Environment variables added or changed

Manifest uploads — upload a Kubernetes YAML manifest via IaC in the sidebar. InfraAudit parses it and compares the declared configuration against the live cluster state to detect IaC drift.

Vulnerability scanning for Kubernetes

For Kubernetes workloads, Trivy scans the container images referenced in your pods and deployments. Trigger a scan:

infraudit vuln scan --provider <kubernetes-cluster-id>

Or configure the scheduled vulnerability_scan job under Jobs to run against your Kubernetes providers automatically.

Multi-cluster management

InfraAudit shows a unified view across all registered clusters. Use the Cluster dropdown at the top of any workload view to filter by cluster.

CLI reference

# List registered clusters
infraudit kubernetes clusters

# List namespaces for a cluster
infraudit kubernetes namespaces --cluster <cluster-id>

# List deployments
infraudit kubernetes deployments --cluster <cluster-id>

# List pods in a specific namespace
infraudit kubernetes pods --cluster <cluster-id> --namespace production

# List services
infraudit kubernetes services --cluster <cluster-id>

Next steps

• Drift detection — run drift scans against your Kubernetes workloads
• Vulnerabilities — review CVE findings for your container images
• Connecting cloud accounts — detailed RBAC and credential requirements