Skip to content
Sencai.docs

Kubernetes clusters

Fleet → Kubernetes Clusters (/gravity/fleet/kubernetes) connects a Kubernetes cluster to Sencai through a lightweight in-cluster agent - a different mechanism from the host fleet agent described elsewhere in this section. There’s no enrollment token exchanged for a certificate, no per-node install, and the agent that runs in your cluster shares nothing at runtime with the host-level agent.

What it reports today

Section titled “What it reports today”

This is enough to answer “is this cluster up, and roughly how big is it” from Sencai without a separate kubectl session, but not yet “what exactly is running in it.”

Connecting a cluster

Section titled “Connecting a cluster”
  1. Open Fleet → Kubernetes Clusters and click Connect Cluster.
  2. Give the cluster a name - this is just a label shown in the table, not tied to the cluster’s own configuration.
  3. Click Generate Token to issue a registration token (this requires an organization Owner or Admin role).
  4. Install the agent into your cluster with Helm. The chart is not published to a public Helm repository, so helm install against a repo name will not work - ask your account team for the chart and for the API URL to use as sencai.apiUrl, then run the install from the unpacked chart directory:
Terminal window
helm install sencai-agent ./helm/sencai-agent \
  --namespace sencai-system --create-namespace \
  --set sencai.apiUrl=<platform-api-url> \
  --set sencai.registrationToken=<your-token> \
  --set sencai.clusterName=<your-cluster-name>

A flat Kubernetes manifest (no Helm required) is provided alongside the chart if you’d rather apply it directly with kubectl - ask for it in the same request.

The registration token alone determines which organization the cluster registers under - there’s no separate organization field to fill in, and getting the cluster name wrong only affects the label shown in the app, not which organization the cluster ends up in.

Confirming it connected

Section titled “Confirming it connected”

The cluster appears in the table with status pending immediately after install, and switches to connected once its first heartbeat arrives - usually within 30 seconds. Click into a cluster for its detail view: Kubernetes version, agent version, namespace, last heartbeat, and the current node/pod/namespace counts.

What it needs access to

Section titled “What it needs access to”

The in-cluster agent only requires read access to nodes, pods, and namespaces (list/watch, not even get on individual objects) - it has no write access to anything in your cluster’s workloads. It runs as a single-replica deployment, not one instance per node.

Managing registration tokens

Section titled “Managing registration tokens”

Fleet → Kubernetes Clusters → Registration Tokens shows every token you’ve issued and lets you revoke ones you no longer need - useful if a token was generated but never used, or if you want to invalidate one that may have been exposed.

Disconnecting a cluster

Section titled “Disconnecting a cluster”

Clicking Disconnect on a cluster removes it from Sencai’s records, but it does not uninstall the agent from your cluster - do that separately with helm uninstall (or kubectl delete if you used the flat manifest) once you’ve disconnected it here.

What’s next

Section titled “What’s next”