Skip to main content
Configuration clusters let a platform team manage supported Komodor Agentic Operation Platform (KAOP) resources from Kubernetes manifests kept in source control. An operator in your cluster reconciles those declarations through the KAOP API and records which cluster owns each resource.

​
Connect a cluster

Open Settings → Configuration clusters, choose Add cluster, and follow the generated instructions.
1

Save the credential

KAOP displays the cluster credential once. Store it securely before leaving the screen.
2

Create the Kubernetes Secret

Use the generated command to place the credential in a Kubernetes Secret. The credential is not embedded in the Helm command or stored as a Helm value.
3

Install the operator

Run the generated Helm command. It includes the KAOP URL, namespace, and Secret name required by the operator.
4

Confirm the first sync

Return to the configuration-clusters list and verify that the cluster reports a recent sync.
The generated install commands remain available from the cluster row because they do not contain the credential value.

​
Read cluster status

Each cluster reports its namespace, operator version, declared-resource count, and last sync.

​
Understand the Cluster-managed badge

Resources declared by an operator carry a Cluster-managed badge, or Cluster-managed, not enforced when the owning cluster is paused. The effect of a console or API edit depends on the cluster’s state and ownership enforcement: Ownership enforcement is turned on per account, and it is off by default — reconciliation and the badge above work the same way either way, but an edit made in KAOP is only ever refused once enforcement is on for your account. Treat the manifest as the source of truth whenever a resource is cluster-managed. For the manifests themselves — the supported kinds, an annotated example, and how to read a resource’s status — see Declaring resources.

​
Pause, resume, or delete a cluster

  • Pause stops reconciliation while preserving the cluster and ownership records.
  • Resume reconciles the manifests again and can overwrite changes made while paused.
  • Delete revokes the cluster’s credential and stops managing its resources. It does not delete the declared resources from KAOP, and it cannot be undone.
Deleting a cluster connection does not uninstall an operator that is still running in Kubernetes. Remove or disable that deployment separately.

​
Rotate the credential

Rotating the credential is the only way to recover from a lost one — KAOP shows it exactly once and cannot read it back. Rotating stops the operator reconciling until it is redeployed with the new Secret, and today it is only available through the API: POST /api/v1/iac-cluster-installs/{install_id}/credential.

​
Next steps

Declaring resources

The kinds a cluster can declare, an annotated manifest, and how to read status.

Audit log

Review cluster connection and lifecycle changes.

Roles & permissions

Control who can view or manage configuration clusters.

Credentials & secrets

Manage one of the resource types a cluster can declare.

MCP Gateway

Configure governed access to MCP servers.