Reach your cluster
Use kubectl with your own Rockslab sign-in. No shared admin file is passed around, and nothing has to be taken back when someone leaves.
Get the kubeconfig
On the cluster's page, ⋯ › kubeconfig… › Download. The file holds the API server address, its certificate, and a way to sign in — but no secret. It is the same file for everyone, so you can drop it in a repo without a second thought.
Sign in
- 1
Install kubelogin once
kubectl krew install oidc-login, orbrew install kubelogin. - 2
Run any command
KUBECONFIG=./test1.yaml kubectl get nodesopens your browser at the platform's sign-in. After that, the token is cached and refreshed for you. - 3
No browser on that machine?
Use the
<cluster>-devicecontext:kubectl --context test1-device get podsprints a code and a link to open on any device.
What you may do
Your rights in the cluster follow your role: owners and admins are cluster-admin, operators run workloads in namespaces an admin made for them, members can look, billing sees nothing. Remove someone from the organization and their access ends when their current token does.
An admin kubeconfig for CI/CD
Owners and admins can also take a long-lived cluster-admin kubeconfig for pipelines and tools — Download kubeconfig on the cluster's page. Unlike the sign-in file this one is a secret: store it like one. Rotate it and every older copy stops working at once. It goes away by itself when its holder stops being an owner or admin.
Break-glass
When sign-in is broken and no admin kubeconfig is at hand, an owner can take cluster-admin for 8 hours, with a reason that lands in the audit log. It is the fire extinguisher behind the glass: good to know it is there, better never to need it.