Kubernetes integration: connect workloads, pods and services to Polylane
Connect Kubernetes workloads, services and pods to Polylane through an outbound agent. Diagnose cluster failures with read-only kubectl investigations.
Get started for freeHow to set up Kubernetes
The product guide says cluster registration usually takes under a minute after installation. Initial workload discovery follows registration.
- Start the Kubernetes connection in Polylane. The flow creates a Polylane API key scoped to cloud_accounts:write.
- Run the displayed Helm install command for oci://ghcr.io/coreplanelabs/charts/polylane-k8s in the polylane namespace with your cluster name and API key. For production, use apiKey.existingSecret instead of putting the key on the command line.
- Check the registered cluster in Polylane. If it does not appear, inspect the agent pod and its logs in the polylane namespace.
Permissions and access
The agent uses read-only Kubernetes RBAC: get, list and watch. It registers once with the cloud_accounts:write Polylane key and establishes an outbound Cloudflare Tunnel; cluster credentials stay inside the cluster. The documented agent flow has no full-access mode. A complete resource-by-resource Helm RBAC manifest was not available in the checked product sources; review the chart before installation.
Discovery, refresh and the connected view
Cluster inventory sync is scheduled every 15 minutes, separately from the three-minute agent liveness probe. Namespaces, nodes, workloads, pods, services, ingress, volumes and policy resources appear in the graph. The kubectl investigation tool makes read-only calls through the agent rather than requiring a public Kubernetes API endpoint.
Disconnect and revoke access
Run helm uninstall polylane --namespace polylane, disconnect the cluster in Polylane, and revoke the agent API key under Settings → API keys. Disconnecting also tears down the managed tunnel.
Provider credentials and Polylane’s access mode are separate. Where write-capable tools exist, the connected account’s Settings page offers a Read-only switch. Turning it off permits writes subject to review and confirmation, but cannot add permissions to the provider credential. Agent-connected Kubernetes clusters stay read-only.
In the graph.
Every Kubernetes resource Polylane picks up sits in the graph with its connections, config and history.
Namespace Node Deployment Stateful Set Daemon Set Replica Set Job Cron Job Pod Service Ingress Config Map Secret Service Account Role Role Binding Cluster Role Cluster Role Binding Persistent Volume Persistent Volume Claim Storage Class Network Policy Horizontal Pod Autoscaler Pod Disruption Budget Tools for the investigation.
What Polylane can do with Kubernetes while it investigates. Every call is recorded in the transcript.
Kubernetes Polylane MCP -
kubectlRead and operate on Kubernetes resources on a connected cluster (get/list/describe/logs/events/top/rollout, plus scale, restart, patch, delete, apply)
Kubernetes setup and troubleshooting
Docker context deadline exceeded
Common questions.
How does Polylane connect to my Kubernetes cluster?
Start the Kubernetes connection in Polylane. The flow creates a Polylane API key scoped to cloud_accounts:write. Run the displayed Helm install command for oci://ghcr.io/coreplanelabs/charts/polylane-k8s in the polylane namespace with your cluster name and API key. For production, use apiKey.existingSecret instead of putting the key on the command line. Check the registered cluster in Polylane. If it does not appear, inspect the agent pod and its logs in the polylane namespace.
What Kubernetes resources does Polylane sync?
Cluster inventory sync is scheduled every 15 minutes, separately from the three-minute agent liveness probe. Namespaces, nodes, workloads, pods, services, ingress, volumes and policy resources appear in the graph. The kubectl investigation tool makes read-only calls through the agent rather than requiring a public Kubernetes API endpoint.