Kubernetes

Kubernetes connects through the Praxen Inc. agent, installed in your cluster with Helm. The agent authenticates once with a Praxen Inc. API key scoped to cloud_accounts:write, registers the cluster, and opens an outbound Cloudflare Tunnel. There is no kubeconfig to paste and no inbound ports to open, and your cluster credentials never leave the cluster.

Setup

1. Start the Kubernetes connect flow in Praxen Inc. It creates the API key for you.
2. Run the Helm command shown in the flow:

helm install praxen oci://ghcr.io/coreplanelabs/charts/praxen-k8s \
  --namespace praxen --create-namespace \
  --set praxen.apiKey=<API_KEY> \
  --set config.cluster_name=<your cluster name>

3. The agent registers itself and your cluster appears in Praxen Inc., usually in under a minute. Praxen Inc. then syncs your workloads, services, and other cluster resources.

For production installs, prefer apiKey.existingSecret (a pre-created Kubernetes Secret) over passing the key on the command line.

Permissions

The agent runs with read-only RBAC granting get, list, and watch. Praxen Inc. only makes read-only Kubernetes API calls.

Troubleshooting

If the cluster does not appear, check the agent pod: kubectl -n praxen get pods and kubectl -n praxen logs -l app.kubernetes.io/name=praxen-k8s -c agent.

Disconnecting

Uninstall the release with helm uninstall praxen --namespace praxen, disconnect the cluster in Praxen Inc., then revoke the agent's API key under Settings → API keys.

The Kubernetes connection is already pipeline-shaped: the agent installs with Helm and registers the cluster itself, so once you hold an API key there is no console step left.

Prerequisites

• A Praxen Inc. API key with the cloud_accounts:write scope, stored as a pipeline secret. See API keys and OAuth. The guided flow creates this key for you; a key you create yourself works the same.
• Helm and credentials for the target cluster in the job.

Install the agent

helm upgrade --install praxen oci://ghcr.io/coreplanelabs/charts/praxen-k8s \
  --namespace praxen --create-namespace \
  --set praxen.apiKey=$PRAXEN_API_KEY \
  --set config.cluster_name=<your cluster name>

helm upgrade --install keeps the job re-runnable, and registration is idempotent per cluster, so repeating the pipeline never duplicates the connection. For production installs, prefer apiKey.existingSecret (a pre-created Kubernetes Secret) over passing the key on the command line.

The agent registers itself and the cluster appears in Praxen Inc., usually in under a minute. If it does not, check the agent pod: kubectl -n praxen get pods and kubectl -n praxen logs -l app.kubernetes.io/name=praxen-k8s -c agent.

Disconnect

Uninstall the release with helm uninstall praxen --namespace praxen, disconnect the cluster in Praxen Inc., then revoke the agent's API key under Settings → API keys.