Skip to content
Documentation
Integrations
Data sources
Kubernetes

Kubernetes

What it gives you — pod_status, kube_events, controller_logs and pod_logs: the baseline cluster-introspection tools every investigation can reach for, via client-go.

How it’s enabled

There is no config key for this one. RunLore builds a read-only clientset automatically — rest.InClusterConfig() first, falling back to the local kubeconfig ($KUBECONFIG, then ~/.kube/config) — and registers the cluster tools whenever that succeeds. No cluster reachable (a local run with no kubeconfig) simply leaves them unregistered; nothing else changes.

controller_logs is additionally gated on gitops.engine: flux — it exists to surface why a Flux controller failed to reconcile, so it isn’t registered under argocd.

Verify it locally 

kubectl -n runlore logs deploy/runlore | grep -E 'tool=pod_status|tool=kube_events|tool=controller_logs|tool=pod_logs'

If the clientset itself fails to build, RunLore logs it instead of registering the tools silently:

kubectl -n runlore logs deploy/runlore | grep 'clientset unavailable'

Notes

  • pod_status / kube_events are cluster-wide — an investigation’s incident namespace is arbitrary (e.g. apps/payments), so pod status and event reads need cluster scope. RunLore’s ClusterRole grants get/list on pods and get/list/watch on events for exactly this, and nothing else — no pods/log at cluster scope.
  • pod_logs is namespace-restricted at two layers, because raw log bodies can carry secrets/PII that would otherwise flow straight to the LLM: a namespaced RBAC Role scoped to rbac.controllerLogNamespaces (chart default [flux-system]), and an app-layer allowlist (config.investigation.pod_log_namespaces) enforced before the cluster is even queried — a request for any other namespace is rejected at the app layer, not just denied by RBAC. The chart auto-defaults the app-layer allowlist to the RBAC namespace list, so the two stay in sync unless you override one.
  • Every pod’s log fetch is bounded: up to 5 matching pods, 300 tail lines each, and every container is read explicitly (a pod with 2+ containers — an istio/linkerd/cloudsql sidecar, say — rejects a log request with no container named, so RunLore always names one).
  • pod_logs can also read a previously-terminated container’s logs (the crash output of a CrashLoopBackOff) instead of the running one.
  • The ServiceAccount’s RBAC grants no write verbs by default — see Security model → Least-privilege RBAC for the full ClusterRole and the write-verb ladder actions.mode climbs.

Reference

OpenSearchCilium Hubble