Cloud and Kubernetes
Cloud accounts and clusters appear in an inventory under Cloud & Kubernetes, and Garry can inspect them when you ask (“which EC2 instances are open to the internet?”, “what did we spend this month?”).
| Provider | Status | Credentials |
|---|---|---|
| Amazon Web Services | Available, tested | Access key ID, secret access key, default region |
| Microsoft Azure | Available, tested | Subscription ID, tenant ID, client (app) ID, client secret |
| Kubernetes | Available, tested | A kubeconfig |
| Hetzner Cloud | Available | API token |
| Google Cloud, DigitalOcean, Linode | Planned |
Connect
Section titled “Connect”Open Connections → Cloud & Kubernetes and click Add integration, choose the provider, fill in the credentials and save. Garrison validates them at once and syncs the inventory.
Credentials are encrypted on the appliance and are used only on the appliance.
Least privilege
Section titled “Least privilege”Give Garrison read-only credentials to start (for AWS, the ReadOnlyAccess managed policy
plus ce:GetCostAndUsage for cost questions). Garrison works fully read-only: it reads on its own
and proposes changes for approval. Grant write permissions only for changes you want it to be able
to make once approved.
| What Garry does | AWS | Azure | Kubernetes |
|---|---|---|---|
| Read (describe, list, get) | Runs at once | Runs at once | Runs at once |
| Change | Proposed, runs after approval | Not run: Garry gives you the command to run yourself | Proposed, runs after approval |
| Secrets (Secrets Manager values, parameters with decryption, Key Vault, storage keys) | Never read without approval | Never read | n/a |
In the inventory
Section titled “In the inventory”The Cloud & Kubernetes page lists every resource by account and type. Select resources and
they become the context of your next chat question. Each account also has a mention and a tag
(@roys-aws, #roys-aws) you can use in chat and in scheduled jobs.