# Kubernetes Clusters > Save a Kubernetes cluster once (GKE, EKS, AKS or any context of your kubeconfig) and open it as a tab next to your terminals: the health of its workloads (deployments, statefulsets, daemonsets with ready vs desired replicas), its pods (status such as CrashLoopBackOff or ImagePullBackOff, restarts, node), the recent events and the logs of any pod. - Area: Desktop, mobile and web - Plans: All plans - Last checked against the product: 2026-10-16 - Web page: https://agentsroom.dev/docs/kubernetes-clusters ## What it does Save a Kubernetes cluster once (GKE, EKS, AKS or any context of your kubeconfig) and open it as a tab next to your terminals: the health of its workloads (deployments, statefulsets, daemonsets with ready vs desired replicas), its pods (status such as CrashLoopBackOff or ImagePullBackOff, restarts, node), the recent events and the logs of any pod. The view refreshes every 15 seconds while it is on screen. Agents reach the same clusters over MCP to read logs, check a rollout or, when you allow it, restart a deployment, without ever handling a credential: AgentsRoom runs `kubectl` itself with your own kubeconfig and cloud login. AgentsRoom stores no token: a saved cluster is only the name of a kubeconfig context. ## Where to find it - Inside a project, the room dock: **Commands & connections**, then the **Kubernetes** tab of the modal (Commands · Servers · Databases · Kubernetes · Secrets). - Command palette (Cmd K / Ctrl K): saved clusters are a source (type the cluster name, "kubernetes" or "k8s"). - Phone: the **Kubernetes** tab of the project's connections sheet (read-only view). ## How to use it 1. Make sure the cluster is in the kubeconfig of this machine. If it is not, run your cloud's command once in a terminal: `gcloud container clusters get-credentials CLUSTER --region REGION --project PROJECT` (GKE), `aws eks update-kubeconfig --name CLUSTER --region REGION` (EKS) or `az aks get-credentials --resource-group GROUP --name CLUSTER` (AKS). The form shows these commands when it finds no context. 2. **New cluster**: optional **Kubeconfig file** (blank = kubectl's default, `$KUBECONFIG` then `~/.kube/config`; **Browse** stores it as `~/...` so it works on your other machines), **Kubeconfig context** (picked from the contexts found on this machine, or typed), **Name** (filled from the context), **Default namespace** (blank = the context's own), scope (this project only or every project of your account), **Read-only** (on by default), **Production**, description. **Test connection** asks the API server for its version with that context. 3. Click the cluster (or **Open**): the cluster tab opens. Pick a namespace (**Context default**, **All namespaces** or one namespace), switch between **Workloads**, **Pods** and **Events** (each shows its health count), tick **Problems only** to hide what is healthy, click **Logs** on a pod (container picker, **Previous container** for the crash before the last restart, number of lines, copy). 4. **Restart** on a workload runs `kubectl rollout restart` after a confirmation that names the cluster, the namespace and the workload. It is only available on a cluster that is not read-only. The cluster list and its order follow your account: a cluster saved on one computer appears on your other computers (and on your phone through the desktop), and opens there as soon as that computer has the same context in its kubeconfig. ## Settings None. Each cluster carries its own **Read-only** and **Production** switches. ## Agent tools (MCP) - `kube_list`: the saved clusters (name, context, default namespace, cloud, read-only, production). Never a credential. - `kube_status`: health summary of a namespace or of the whole cluster: unhealthy workloads, pods that are not ready, recent Warning events. - `kube_kubectl`: one kubectl command on a saved cluster, as an argv (`["logs", "", "--tail=200"]`, `["rollout", "status", "deployment/api"]`). Reads run directly. Writes (`rollout restart | undo`, `scale`, `delete`, `apply`…) are refused on a read-only cluster and otherwise wait for your approval in a card in the agent's pane (the same card as PowerShell writes, also shown on the phone). Always refused: `exec`, `port-forward`, `cp`, `config`, `--watch` / `--follow`, flags that change the target cluster or the identity (`--context`, `--token`, `--as`…) and reading Secret values. - `ui_open` with `surface: "kube"` opens the Kubernetes list for you. ## Providers All providers, no difference: the tools are served by the AgentsRoom MCP server to every agent CLI that has an MCP client. ## Mobile Read-only: the list of clusters, the namespace chips, the three sections with the same health words, and the logs of a pod (with the previous container). No restart from the phone: writes stay on the desktop, where the confirmation names the cluster. The phone needs the desktop online, which runs kubectl. ## Limits - Needs `kubectl` on the computer, and the login plugin of your cloud for managed clusters (`gke-gcloud-auth-plugin`, `aws` or `kubelogin`). AgentsRoom finds them on your PATH and in the usual install folders on macOS, Windows and Linux; when one is missing the error says which and how to fix it. - Lists come from `kubectl get`: very large namespaces (thousands of pods) load more slowly. The 80 most recent events are kept. - An account that may not list a kind (RBAC) still sees the others, with a note saying what could not be listed. - No shell into a container, no port forward, no YAML editor: use your terminal for those. ## Common questions - **Does AgentsRoom store my cluster token?** No. A saved cluster is the name of a kubeconfig context. Tokens, certificates and cloud logins stay in your kubeconfig and your cloud CLI, and agents never see them. - **Can an agent restart my deployment?** Only on a cluster you made writable (untick **Read-only**), and each write waits for your approval in the agent's pane. - **"executable gke-gcloud-auth-plugin not found"?** Install it with `gcloud components install gke-gcloud-auth-plugin` and reopen the cluster. - **"Unauthorized" or "token expired"?** Log in again with your cloud CLI (`gcloud auth login`, `aws sso login`, `az login`). - **My cluster does not appear in the context list.** Run your cloud's get-credentials command on this computer, or point **Kubeconfig file** at the right file, then **Reload**. - **Can I watch my cluster from my phone?** Yes, read-only, from the **Kubernetes** tab of the project's connections sheet, while your desktop is online. ## Related - [Database Connections](https://agentsroom.dev/docs/database-connections.md): the same "saved connection opened as a tab" pattern for SQL. - [SSH Connections](https://agentsroom.dev/docs/ssh-connections.md): remote machines; a cluster needs no SSH, kubectl talks to the API server directly. - [AgentsRoom MCP](https://agentsroom.dev/docs/agentsroom-mcp.md): every MCP tool agents get.