Integration · Kubernetes
Kubernetes + OrchestrAI
Catalog exported 2026-09-02 · Kubernetes website
Run kubectl get, describe, logs, apply, rollout, and exec from chat, with Velero backups and cluster creation.
OrchestrAI exposes 29 Kubernetes operations: 9 are low-risk (read-only or low-impact), 18 create or modify resources and run only after you confirm the plan, and 2 are destructive and require a typed risk phrase. 20 of them also carry a step-level approval gate.
What teams use it for
Platform engineers use OrchestrAI as a kubectl operator: get and describe resources, read pod logs, check rollout status, and switch contexts while investigating a failing deployment. Apply, exec, rollout restart, and rollout undo are high risk and confirmed, port-forward, cp, create, and context switching are medium and confirmed, and delete is critical with a typed risk phrase. Velero backup and restore, EKS, GKE, and AKS cluster creation, and chaos experiments are gated the same way. There is no operation to scale a deployment, edit a resource in place, or drain a node, so use kubectl for those.
Every Kubernetes operation, with its risk level
| Operation | What it does | Risk | Step-level approval |
|---|---|---|---|
Helm History |
Get release history | Low risk | No |
Helm List |
List Helm releases | Low risk | No |
Helm Status |
Get status of a Helm release | Low risk | No |
Kubectl Describe |
Describe a Kubernetes resource | Low risk | No |
Kubectl Get |
Get Kubernetes resources | Low risk | No |
Kubectl Get Contexts |
List available contexts | Low risk | No |
Kubectl Get Namespaces |
List all namespaces | Low risk | No |
Kubectl Logs |
Get pod logs | Low risk | No |
Kubectl Rollout Status |
Check rollout status | Low risk | No |
Create Velero Backup |
Create Kubernetes backup with Velero | Creates resources | Yes |
Helm Install |
Install a Helm chart | Creates resources | Yes |
Kubectl Copy |
Copy files to/from a pod | Creates resources | Yes |
Kubectl Create |
Create a Kubernetes resource | Creates resources | Yes |
Kubectl Port Forward |
Forward ports to a pod or service | Creates resources | Yes |
Kubectl Use Context |
Switch to a different context | Creates resources | Yes |
Add Cluster to ArgoCD |
Add a Kubernetes cluster to ArgoCD | Modifies existing | Yes |
CPU Stress Test |
Apply CPU stress to target | Modifies existing | Yes |
Create Kubernetes Cluster (Multi-Cloud) |
Create Kubernetes cluster on any cloud (EKS/GKE/AKS) | Modifies existing | Yes |
Create Network Partition |
Create network partition between services | Modifies existing | Yes |
Helm Rollback |
Rollback a Helm release to a previous revision | Modifies existing | Yes |
Helm Upgrade |
Upgrade a Helm release | Modifies existing | Yes |
Inject Chaos Failure |
Inject failure into service (pod-kill, latency, etc.) | Modifies existing | Yes |
Kubectl Apply |
Apply a manifest to the cluster | Modifies existing | Yes |
Kubectl Exec |
Execute a command in a pod | Modifies existing | Yes |
Kubectl Rollout Restart |
Restart a rollout | Modifies existing | Yes |
Kubectl Rollout Undo |
Undo a rollout | Modifies existing | Yes |
Restore from Velero Backup |
Restore Kubernetes from Velero backup | Modifies existing | Yes |
Helm Uninstall |
Uninstall a Helm release | Destructive | Yes |
Kubectl Delete |
Delete a Kubernetes resource | Destructive | Yes |
Risk tiers come from the catalog: low is read-only or low-impact, medium creates resources and is reversible, high modifies existing resources, destructive may lose data. Every plan that creates or changes resources is shown with its cost estimate and waits for your confirmation. Operations marked with a step-level approval pause again on their own step. Destructive operations require a typed risk phrase.
What you connect
A Kubernetes credential (stored as argocd, kubernetes, velero).
Operations that touch your cloud account use your connected AWS or GCP or AZURE role through a short-lived token minted per run.
Connected-service tokens are envelope-encrypted with a per-record key wrapped by a cloud KMS.
Prompts that work
- Show pods in namespace payments that are not Running and describe the first one
- Restart the rollout for deployment checkout-api in the prod namespace
- Create a Velero backup of the namespace orders before we upgrade Postgres
Before anything runs
Every mutation shows its plan, cost estimate, and blast radius, then waits for your confirmation. Destructive operations require a typed risk phrase. Credentials are minted per run through OIDC federation and discarded afterward; nothing you create here is invisible later, because every resource lands in the desired-state ledger where drift is detected and can be converged. Details on the security page.
Frequently asked questions
- Can OrchestrAI delete Kubernetes resources?
- Yes, but kubectl delete is classified as critical. It waits for confirmation and requires a typed risk phrase before anything is removed.
- Does OrchestrAI create Kubernetes clusters?
- Yes. It can create an EKS, GKE, or AKS cluster using your cloud role. That is a high-risk operation, so it shows the plan and cost estimate and waits for confirmation.
- How does OrchestrAI authenticate to Kubernetes?
- You add a Kubernetes credential once in the connections screen. It is envelope-encrypted with a per-record key wrapped by a cloud KMS and is only decrypted inside the run that needs it. Some Kubernetes operations also act on your AWS or GCP or AZURE account, which uses a short-lived OIDC-federated token instead of stored keys.
Related integrations
Cloud services this pairs with
Try it on your own account
Connect your cloud read-only and see your resources, drift, and costs before anything runs. $5 minimum to start. Unused credits refunded in your first 14 days.
Unused credits refunded in your first 14 days.