Kubernetes#

The Kubernetes module ingests cluster inventory, workloads, networking resources, secrets metadata, and RBAC identities and permissions. It also connects Kubernetes resources to cloud infrastructure, container images, and shared ontology labels so that workload and identity paths can be queried across providers.

Use the configuration guide to grant read-only access and connect one or more clusters. The schema reference is generated from the model definitions and is included automatically in the built documentation. The query guide contains operational examples for inspecting the resulting graph.

Optional permission behavior#

When Gateway API CRDs are absent, Cartography treats Gateway API inventory as empty and cleans stale KubernetesGateway and KubernetesHTTPRoute nodes. If the CRDs exist but the identity cannot list them, Cartography skips ingestion and cleanup, preserving existing nodes. Ingested gateways and HTTP routes form the Gateway -[:ROUTES]-> HTTPRoute -[:TARGETS]-> Service traffic path.

If the identity cannot list network policies, Cartography skips both ingestion and cleanup and preserves existing KubernetesNetworkPolicy nodes. Ingested policies use APPLIES_TO edges to identify selected pods.

If the identity cannot list secrets, Cartography skips secret ingestion and cleanup and preserves existing KubernetesSecret nodes. Cartography stores only secret metadata, never secret content.

For EKS, Cartography reads mapRoles, mapUsers, and mapAccounts from the legacy aws-auth ConfigMap when permitted. Account mappings connect every already-synced IAM principal from the listed AWS account to a KubernetesUser named for the principal ARN. Without the ConfigMap, Access Entries and external OIDC mappings still load, but stale identity cleanup removes mappings that were previously supplied only by aws-auth.