K8S Setup

Kubernetes Setup

Use this skill when the plugin is unconfigured or the user wants another Kubernetes environment.

If this deployment cannot edit the active Datus config, tell the user to ask the deployment administrator instead.

Information to collect

For managed Kubernetes collect the provider plugin (eks, gke, aks, or ack), provider profile, and namespace. The provider profile owns the cluster name/ID. When provider and k8s profile names match, omit provider_profile.

For a generic cluster collect:

1. A kubeconfig path. It may be absolute, ${KUBECONFIG}, or relative to the current Datus project directory, such as ./conf/kubeconfig.yaml.
2. An optional context. If omitted, the plugin uses kubeconfig current-context at runtime.
3. The default namespace.
4. Every allowed namespace, as a comma-separated string.

Do not copy tokens, certificates, or client keys out of kubeconfig.

Configuration

Add a profile under agent.plugins.k8s in the config file named by the ## Plugins system-prompt section:

agent:
  plugins:
    k8s:
      datus-dev:
        default: true
        provider: eks
        namespace: analytics

      prod:
        kubeconfig: ./conf/kubeconfig.yaml
        # context: prod-cluster       # optional; otherwise current-context
        namespace: analytics
        allowed_namespaces: analytics,analytics-staging
        request_timeout: 30s
        field_manager: datus-k8s

      gcp-prod:
        provider: gke
        namespace: analytics

      azure-prod:
        provider: aks
        namespace: analytics

      aliyun-prod:
        provider: ack
        namespace: analytics

For managed Kubernetes, allowed_namespaces defaults to namespace. The cloud plugin owns identity, AssumeRole/workload identity, cluster discovery, and short-lived credential refresh. Credentials may be bearer tokens or client certificate/private key pairs; never copy cloud credentials into the k8s profile. If the provider profile has a different name, set provider_profile. If it comes from a non-default --config file, set provider_config to that same agent.yml path.

Relative paths are resolved from the directory where Datus is started and may not escape it through .. or symlinks.

Verify

datus k8s --profile prod version
datus k8s --profile prod auth can-i get pods -n analytics
datus k8s --profile prod get pods -n analytics