Skip to main content
This connector requires network access to your Kubernetes API server. If your cluster API endpoint is not publicly accessible, run the connector in self-hosted mode, deployed inside the cluster itself.

​
Capabilities

ResourceSyncProvision
Namespaces
Service accounts
Kubernetes users
Kubernetes groups
Roles
Cluster roles
Nodes
Pods
Deployments
StatefulSets
DaemonSets
Secrets
ConfigMaps

​
Before you begin

You’ll need:
  • A running Kubernetes cluster
  • kubectl configured to connect to the cluster
  • Permissions to create namespaces, service accounts, and RBAC resources in the cluster

​
Set up RBAC permissions in your cluster

The connector uses a Kubernetes service account to read cluster state. Apply the following manifest to create the namespace, service account, and the read-only RBAC permissions it needs. 
apiVersion: v1
kind: Namespace
metadata:
  name: baton
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: baton-kubernetes
  namespace: baton
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: baton-kubernetes-reader
rules:
  - apiGroups: [""]
    resources:
      - namespaces
      - nodes
      - pods
      - secrets
      - configmaps
      - serviceaccounts
    verbs: ["get", "list", "watch"]
  - apiGroups: ["apps"]
    resources:
      - deployments
      - statefulsets
      - daemonsets
    verbs: ["get", "list", "watch"]
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources:
      - roles
      - rolebindings
      - clusterroles
      - clusterrolebindings
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: baton-kubernetes-reader
subjects:
  - kind: ServiceAccount
    name: baton-kubernetes
    namespace: baton
roleRef:
  kind: ClusterRole
  name: baton-kubernetes-reader
  apiGroup: rbac.authorization.k8s.io
Save this as baton-rbac.yaml and apply it: 
kubectl apply -f baton-rbac.yaml

​
Configure the Kubernetes connector

To complete this task, you’ll need:
  • The Connector Administrator or Super Administrator role in C1
Follow these instructions to deploy the Kubernetes connector inside your cluster.When running in service mode, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.

​
Resources

  • GitHub repository: Access the source code, report issues, or contribute to the project.

​
Step 1: Set up a new Kubernetes connector in C1

Navigate to Integrations in C1 to register a new connector and generate credentials.
1
In C1, navigate to Integrations > Connectors > Add connector.
2
Search for Baton and click Add.
3
Choose how to set up the new connector:
  • Add the connector to a currently unmanaged app
  • Add the connector to a managed app
  • Create a new managed app
4
Set the owner for this connector and click Next.
5
In the Settings area of the page, click Edit.
6
Click Rotate to generate a new Client ID and Secret. Copy and save these credentials — you’ll need them in the next step.

​
Step 2: Deploy the connector to your cluster

Create a secret with your C1 credentials and deploy the connector using the service account created earlier.
apiVersion: v1
kind: Secret
metadata:
  name: baton-conductorone-creds
  namespace: baton
type: Opaque
stringData:
  BATON_CLIENT_ID: "<C1 client ID>"
  BATON_CLIENT_SECRET: "<C1 client secret>"
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-kubernetes
  namespace: baton
spec:
  replicas: 1
  selector:
    matchLabels:
      app: baton-kubernetes
  template:
    metadata:
      labels:
        app: baton-kubernetes
    spec:
      serviceAccountName: baton-kubernetes
      containers:
        - name: baton-kubernetes
          image: ghcr.io/conductorone/baton-kubernetes:latest
          envFrom:
            - secretRef:
                name: baton-conductorone-creds
Save this as baton-kubernetes.yaml, fill in your C1 credentials, and apply it:
kubectl apply -f baton-kubernetes.yaml

​
Step 3: Verify the connector is running

Confirm the pod is healthy and that C1 is receiving data from the cluster.
1
Check that the pod started successfully:
kubectl get pods -n baton
kubectl logs -n baton deployment/baton-kubernetes
2
In C1, click Apps. On the Managed apps tab, locate the application you added the connector to. Kubernetes data should appear on the Entitlements and Accounts tabs after the first sync completes.
Done. Your Kubernetes connector is now pulling access data into C1.