Kubernetes integration
Secorvia connects to Kubernetes through a collector that runs in the cluster and reports outbound, or through direct registration with credentials you supply, and ties the cluster inventory to findings and compliance.
What Secorvia reports from a cluster, and what it finds
Once a cluster is connected, its detail page shows when it last reported, the collector version, and counts of nodes, namespaces, workloads and pods. Kubernetes Secret metadata may be shown, but the collector does not collect Secret values. From there you follow the cluster's security posture into the findings list and into the compliance view.
Vulnerabilities in the container images a cluster runs are matched to packages, and that correlation needs the image content digests. Images are scanned through container security, and Kubernetes security and container security both start on the Starter plan. To explore a cluster's relationships in attack paths, rebuild a graph snapshot after the cluster's latest inventory has arrived, because a scan and a graph build are separate steps. This page does not list individual checks, because the product's Kubernetes rule list is not published anywhere this site can quote.
Managed clusters that a cloud scan discovers, such as EKS, AKS, GKE or DigitalOcean Kubernetes, show up as cloud resources. The guide is clear that a cluster discovered that way is not necessarily connected for in-cluster inventory. For that you register the cluster.
What connecting Kubernetes takes
There are two connection models, and the guide leaves the choice to your network and credential policy. Connect Self-Managed Cluster uses an in-cluster collector that reports outbound, so no cloud account, API endpoint or cluster bearer token is needed. Register With Credentials lets Secorvia connect directly to the API server. For that you select a cloud account and enter the optional region, the API server endpoint, the CA certificate in PEM form and a bearer token, and the cluster API must be reachable.
For the collector, you enter a cluster name and complete registration. Secorvia then shows a one-time credential. Copy it into your approved secret store straight away, because Secorvia keeps only its hash and cannot show it again. Use the exact Install with Helm or Install with kubectl command that your deployment generates, and complete any pull-secret prerequisite first. Check whether the displayed image is pinned by digest. Then use the watch-it-connect view, the collector logs and Verify Connection to confirm the first report arrived.
Rotating the credential is a deliberate step. Rotation invalidates the old credential immediately, so you update the Kubernetes Secret and restart the collector, then check that Last authenticated and Last report move forward. Revoking the credential stops reporting but keeps the cluster and its inventory. Removing the cluster removes its discovered inventory after revocation, and findings and audit history are kept. The Kubernetes guide and the credential rotation guide show each screen.
How many clusters you can register depends on the plan: none on Free, one on Starter, ten on Growth and no fixed limit on Enterprise.
What Secorvia does not do on Kubernetes
The collector does not collect Kubernetes Secret values. In the collector model nothing needs to reach into your cluster from outside, because the collector reports outbound. Secorvia reports problems and does not fix them, so a remediation is a change you make in your cluster or your manifests, followed by a new look at the inventory.
The two models differ in what you provide. The collector needs outbound connectivity from the cluster and a credential that you keep in a Secret. Direct registration needs a reachable API server and a bearer token that you supply, and what Secorvia can see through it is bounded by what that token can read.
Kubernetes cluster posture is separate from runtime monitoring. Runtime security uses an agent on a Linux host. The security page says collectors exist only for the deeper workload features, and that you can leave them out and still run the rest of the platform.
Frequently asked questions
Which connection model should I use?
The guide says to use the one that fits your network and credential policy. The collector reports outbound and needs no cloud account, API endpoint or cluster bearer token. Direct registration needs a reachable API server, its CA certificate and a bearer token.
Does the collector read Kubernetes Secrets?
No. The collector does not collect Kubernetes Secret values. Secret metadata may be shown in the cluster inventory.
How many clusters can I register?
None on Free, because Kubernetes security starts on Starter. Starter allows one, Growth allows ten and Enterprise has no fixed limit.
Why does my cluster show no workloads?
Check the collector logs, outbound connectivity, credential validity and the Last report time. A cluster that a cloud scan discovered is not necessarily connected for in-cluster inventory.
What if I lose the collector credential?
It is shown once and Secorvia keeps only its hash, so it cannot be shown again. Rotate the credential, then update the Kubernetes Secret and restart the collector.