External Kubernetes Clusters¶

Overview¶

HPE Morpheus Software supports two primary modes of Kubernetes cluster management:

• Provisioned Clusters — Kubernetes clusters provisioned directly by HPE Morpheus Software using MKS (Morpheus Kubernetes Service) layouts

• External Clusters — Pre-existing Kubernetes clusters provisioned outside of HPE Morpheus Software and imported for management

This guide covers the differences between these approaches, the import process for external clusters, and the feature parity between the two.

Provisioned vs External Clusters¶

Importing an External Cluster¶

Prerequisites¶

Before importing an external cluster, prepare the following:

1. Service Account — Create a service account with cluster-admin privileges:

   kubectl create serviceaccount morpheus
   

2. Cluster Role Binding — Bind the service account to cluster-admin:

   kubectl create clusterrolebinding morpheus-admin \
     --clusterrole=cluster-admin \
     --serviceaccount=default:morpheus \
     --namespace=default
   

3. API URL — Retrieve the cluster API server URL:

   kubectl config view --minify | grep server | cut -f 2- -d ":" | tr -d " "
   

4. API Token — Retrieve the service account token:

   SECRET_NAME=$(kubectl get secrets | grep ^morpheus | cut -f1 -d ' ')
   kubectl describe secret $SECRET_NAME | grep -E '^token' | cut -f2 -d':' | tr -d " "
   

   Note

   For Kubernetes 1.24+, tokens are no longer auto-created for service accounts. Use kubectl create token morpheus or create a long-lived token Secret manually.

5. Kube Config (alternative) — Export the kubeconfig YAML for the cluster.

Import Process¶

1. Navigate to Infrastructure > Clusters

2. Select + ADD CLUSTER

3. Choose External Kubernetes Cluster

4. Select a Group and click NEXT

5. Configure:

   CLOUD

   Select a previously-integrated Cloud (or any Cloud for general association)

   CLUSTER NAME

   Friendly name for the cluster in HPE Morpheus Software

   RESOURCE NAME

   Prefix for Kubernetes hosts shown in HPE Morpheus Software UI

   LAYOUT

   Select an External Kubernetes layout matching the cluster version

   API URL

   The cluster API server URL (from prerequisites)

   API TOKEN

   The service account token (from prerequisites)

   KUBE CONFIG

   Alternatively, paste the full kubeconfig YAML

6. Complete the wizard

HPE Morpheus Software will validate connectivity, sync namespaces, workloads, and storage, and begin ongoing monitoring.

Authentication Methods¶

External clusters support two authentication methods:

• API Token — A bearer token from a Kubernetes service account. Simpler but requires manual rotation.

• Kube Config — Full kubeconfig YAML supporting certificate-based auth, OIDC, and other authentication providers.

At least one of API Token or Kube Config is required. If both are provided, the API Token takes precedence.

Post-Import Capabilities¶

Once imported, external clusters support:

• Workload visibility — All Pods, Deployments, Services, etc. are synced and viewable

• Namespace management — Create, view, and manage namespaces

• kubectl access — Execute commands from the Control tab

• App deployment — Deploy Helm charts and Kubernetes Spec blueprints

• Storage management — View and manage PVs, PVCs, and StorageClasses

• RBAC — View and manage roles, role bindings, and service accounts

• Monitoring — Events and logs are collected and viewable

Limitations of External Clusters¶

• Cannot add or remove worker nodes through HPE Morpheus Software

• Cannot upgrade the Kubernetes version through HPE Morpheus Software

• No agent-based host metrics (CPU, memory at the node level)

• Cannot manage the underlying infrastructure (VMs, networks)

• Cluster provisioning logs are not available

Use Cases for External Clusters¶

• OpenShift integration — Import managed OpenShift clusters for workload deployment

• EKS/GKE/AKS brought externally — Import cloud-managed clusters not provisioned through HPE Morpheus Software

• On-premises clusters — Import clusters built with kubeadm, Rancher, or other tools

• Development clusters — Import minikube or kind clusters for testing

• Multi-cluster management — Centralize visibility across heterogeneous Kubernetes environments

Troubleshooting¶

• Connection refused: Verify the API URL is accessible from the HPE Morpheus Software appliance over port 6443

• Unauthorized: Ensure the API token or kubeconfig credentials are valid and have cluster-admin permissions

• Partial sync: Some resources may not appear if the service account lacks list permissions on specific resource types

• Namespace not visible: The service account must have cluster-level list permissions (not just namespace-scoped)