ServiceNow Kubernetes Integration Guide

Architecture Overview

Implementation Steps

apiVersion: v1
kind: ServiceAccount
metadata:
  name: servicenow-discovery
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: servicenow-discovery-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: servicenow-discovery
  namespace: default

var gr = new GlideRecord('em_event');
gr.initialize();
gr.source = 'Kubernetes';
gr.node = event_payload.involvedObject.name;
gr.type = event_payload.type;
gr.severity = event_payload.type == 'Warning' ? 3 : 5;
gr.description = event_payload.message;
gr.additional_info = JSON.stringify(event_payload);
gr.insert();

// In Flow Designer kubectl action script
var command = 'scale deployment ' + fd_data.deployment_name + ' --replicas=' + fd_data.replica_count + ' -n ' + fd_data.namespace;
var result = inputs.u_kubectl_command = command;
outputs.command_result = result;

Common Use Cases

Troubleshooting

Pro Tips

• →Implement namespace-based RBAC in your Kubernetes clusters and create separate ServiceNow credentials for different namespaces to provide granular access control and support multi-tenancy requirements. This allows different ServiceNow assignment groups to manage their own Kubernetes resources without accessing other teams' workloads.
• →Use ServiceNow's Configuration Compliance to automatically scan Kubernetes resources for security policy violations like pods running as root, missing resource limits, or deprecated API versions. Create compliance rules that trigger change requests when non-compliant resources are detected during discovery runs.
• →Configure custom event correlation rules in Event Management to group related Kubernetes events (like all pods failing in a namespace) into single incidents to prevent alert storms. Use time-based correlation windows and event deduplication based on cluster, namespace, and error message patterns to reduce noise.
• →Leverage ServiceNow's REST API to build custom Kubernetes operators that can create ServiceNow records from within cluster workloads, enabling applications to automatically generate incidents, change requests, or configuration items based on application-specific events and metrics.
• →Set up automated Performance Analytics metrics collection from Kubernetes clusters by scheduling Integration Hub flows that query resource usage APIs and populate custom metrics tables. This enables capacity planning dashboards and predictive scaling recommendations based on historical usage patterns.
• →Implement GitOps workflows where ServiceNow change requests automatically update Git repositories containing Kubernetes manifests, triggering ArgoCD or Flux deployments. This maintains ServiceNow change control while enabling cloud-native deployment practices and audit trails.

Known Limitations

• —The Kubernetes spoke requires Integration Hub Professional licensing, which may not be available in all ServiceNow licensing tiers and represents an additional cost for organizations using the Standard Integration Hub. Custom REST message implementations can provide basic functionality but lack the pre-built actions and error handling of the official spoke.
• —Discovery performance can be significantly impacted when scanning large Kubernetes clusters with thousands of pods, as the API responses may exceed ServiceNow's default payload size limits and cause timeout errors. Large clusters may require custom discovery patterns with namespace filtering to reduce scope and improve reliability.
• —Real-time event integration depends on external monitoring tools like Prometheus AlertManager to transform native Kubernetes events into ServiceNow-compatible formats, as Kubernetes doesn't natively support webhook notifications to external systems. This requires additional infrastructure and monitoring tool configuration beyond the basic ServiceNow integration.
• —The integration cannot automatically detect or remediate split-brain scenarios where Kubernetes resources exist in clusters but are missing from the ServiceNow CMDB due to discovery failures or cluster connectivity issues. Manual reconciliation processes may be required to maintain data consistency between systems.
• —Kubectl-based automation workflows through Integration Hub require MID Server deployment and may introduce security concerns if kubectl commands allow destructive operations without proper approval workflows and change management controls integrated into the flow design.

Frequently Asked Questions