Debugging a pod that keeps restarting usually takes more than metrics and logs. You need the pod's current state, its events, and what changed recently, and that information lives in the cluster, out of the Agent's reach.
The Kubernetes App is now live, bringing a cluster into AI SRE's investigation flow. It uses the same mechanism as the GitHub App and GitLab App for repository access, the Customize App primitive, applied here to a cluster instead of a repository.
Permissions scoped to the namespace
Creating a Kubernetes App starts with a cluster name and a scope: Shared makes it available to any session in the account, or Team limits it to that team's sessions and the personal sessions of that team's members. For namespaces, choose All namespaces to apply one permission level across current and future ones, or Specific namespaces to pick read-only or read + limited write for each one individually. Leave namespaces unspecified and the Agent can only read basic cluster metadata, nothing about individual workloads. Installing the App does not hand the Agent the whole cluster.
You run the install command yourself, the console doesn't do it for you
After saving the configuration, the console generates an install command for you to run against the target cluster yourself. The command expires; reopen the install config or check the Manifest for a fresh one, no token rotation required. Change the namespace or permission scope later and you need to rerun the install command for the in-cluster RBAC to catch up.
Revoking and uninstalling are two separate steps
Revoking in the console immediately invalidates the connection and its token, but it does not automatically remove the Agent or RBAC resources already installed in the cluster. The console provides an uninstall command for that; run it against the cluster yourself. It only removes what this particular Kubernetes App installed, leaving the shared flashduty namespace untouched.
Getting started
Go to Flashduty console → AI SRE → Plugins → Apps → Kubernetes App.
See the product documentation for details.
AI SRE is rolling out to On-call Professional accounts and above, as part of the ongoing public beta.