Kubernetes, Argo CD and Flux

The Service Catalog’s “where is this service running, and is it healthy” dimension is fed by three sources: a direct Kubernetes cluster read, Argo CD and Flux. All three sync in the background every 10 minutes; the Sync now button on the Integrations page triggers a run without the wait.

Kubernetes

Deployment, StatefulSet, DaemonSet and CronJob workloads are read straight from the Kubernetes API - covering everything running, including environments no GitOps tool owns. Pod counts (ready/desired) and workload health come from this read.

Connecting

1. Go to Integrations → Kubernetes → Connect.
2. Enter the API server address (https://...) and a ServiceAccount token.
3. The token is stored encrypted; the connection is verified before it is saved.

Required RBAC

A read-only ServiceAccount is enough. list is needed to read workloads in bulk, and get to read individual workload status (pod counts) - grant both:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: apparch-reader
rules:
  - apiGroups: ["apps"]
    resources: ["deployments", "statefulsets", "daemonsets"]
    verbs: ["list", "get"]
  - apiGroups: ["batch"]
    resources: ["cronjobs"]
    verbs: ["list"]
  # If you run Flux, these three rules are also required (see below):
  - apiGroups: ["source.toolkit.fluxcd.io"]
    resources: ["gitrepositories"]
    verbs: ["list"]
  - apiGroups: ["kustomize.toolkit.fluxcd.io"]
    resources: ["kustomizations"]
    verbs: ["list"]
  - apiGroups: ["helm.toolkit.fluxcd.io"]
    resources: ["helmreleases"]
    verbs: ["list"]

Bind the role to a ServiceAccount and hand its token to AppArch:

kubectl create serviceaccount apparch-reader
kubectl create clusterrolebinding apparch-reader \
  --clusterrole=apparch-reader --serviceaccount=default:apparch-reader
kubectl create token apparch-reader --duration=8760h

Argo CD

Argo CD reports per-Application environment, sync/health state and the running commit. Connect via Integrations → Argo CD → Connect with the Argo CD server address and an API token (needed when anonymous read access is disabled). Pod counts are read from each Application’s resource tree.

Flux

Flux needs no connection of its own - it lives in your cluster as custom resources (Kustomization, HelmRelease) and is read through the existing Kubernetes connection. All you need is the three Flux rules from the RBAC example above on your token. When Flux is detected, a Flux badge appears on the Kubernetes row of the Integrations page.