@@ -151,6 +151,76 @@ var pamSshAccessAccountCmd = &cobra.Command{
151151 pam .StartSSHLocalProxy (loggedInUserDetails .UserCredentials .JTWToken , accountPath , projectID , durationStr )
152152 },
153153}
154+ var pamKubernetesCmd = & cobra.Command {
155+ Use : "kubernetes" ,
156+ Aliases : []string {"k8s" },
157+ Short : "Kubernetes-related PAM commands" ,
158+ Long : "Kubernetes-related PAM commands for Infisical" ,
159+ DisableFlagsInUseLine : true ,
160+ Args : cobra .NoArgs ,
161+ }
162+
163+ var pamKubernetesAccessAccountCmd = & cobra.Command {
164+ Use : "access-account <account-path>" ,
165+ Short : "Access Kubernetes PAM account" ,
166+ Long : "Access Kubernetes via a PAM-managed Kubernetes account. This command automatically launches a proxy connected to your Kubernetes cluster through the Infisical Gateway." ,
167+ Example : "infisical pam kubernetes access-account prod/ssh/my-k8s-account --duration 2h" ,
168+ DisableFlagsInUseLine : true ,
169+ Args : cobra .ExactArgs (1 ),
170+ Run : func (cmd * cobra.Command , args []string ) {
171+ util .RequireLogin ()
172+
173+ accountPath := args [0 ]
174+
175+ durationStr , err := cmd .Flags ().GetString ("duration" )
176+ if err != nil {
177+ util .HandleError (err , "Unable to parse duration flag" )
178+ }
179+
180+ // Parse duration
181+ _ , err = time .ParseDuration (durationStr )
182+ if err != nil {
183+ util .HandleError (err , "Invalid duration format. Use formats like '1h', '30m', '2h30m'" )
184+ }
185+
186+ port , err := cmd .Flags ().GetInt ("port" )
187+ if err != nil {
188+ util .HandleError (err , "Unable to parse port flag" )
189+ }
190+
191+ projectID , err := cmd .Flags ().GetString ("project-id" )
192+ if err != nil {
193+ util .HandleError (err , "Unable to parse project-id flag" )
194+ }
195+
196+ if projectID == "" {
197+ workspaceFile , err := util .GetWorkSpaceFromFile ()
198+ if err != nil {
199+ util .PrintErrorMessageAndExit ("Please either run infisical init to connect to a project or pass in project id with --project-id flag" )
200+ }
201+ projectID = workspaceFile .WorkspaceId
202+ }
203+
204+ log .Debug ().Msg ("PAM Kubernetes Access: Trying to fetch credentials using logged in details" )
205+
206+ loggedInUserDetails , err := util .GetCurrentLoggedInUserDetails (true )
207+ isConnected := util .ValidateInfisicalAPIConnection ()
208+
209+ if isConnected {
210+ log .Debug ().Msg ("PAM Kubernetes Access: Connected to Infisical instance, checking logged in creds" )
211+ }
212+
213+ if err != nil {
214+ util .HandleError (err , "Unable to get logged in user details" )
215+ }
216+
217+ if isConnected && loggedInUserDetails .LoginExpired {
218+ loggedInUserDetails = util .EstablishUserLoginSession ()
219+ }
220+
221+ pam .StartKubernetesLocalProxy (loggedInUserDetails .UserCredentials .JTWToken , accountPath , projectID , durationStr , port )
222+ },
223+ }
154224
155225func init () {
156226 pamDbCmd .AddCommand (pamDbAccessAccountCmd )
@@ -162,7 +232,13 @@ func init() {
162232 pamSshAccessAccountCmd .Flags ().String ("duration" , "1h" , "Duration for SSH access session (e.g., '1h', '30m', '2h30m')" )
163233 pamSshAccessAccountCmd .Flags ().String ("project-id" , "" , "Project ID of the account to access" )
164234
235+ pamKubernetesCmd .AddCommand (pamKubernetesAccessAccountCmd )
236+ pamKubernetesAccessAccountCmd .Flags ().String ("duration" , "1h" , "Duration for kubernetes access session (e.g., '1h', '30m', '2h30m')" )
237+ pamKubernetesAccessAccountCmd .Flags ().Int ("port" , 0 , "Port for the local kubernetes proxy server (0 for auto-assign)" )
238+ pamKubernetesAccessAccountCmd .Flags ().String ("project-id" , "" , "Project ID of the account to access" )
239+
165240 pamCmd .AddCommand (pamDbCmd )
166241 pamCmd .AddCommand (pamSshCmd )
242+ pamCmd .AddCommand (pamKubernetesCmd )
167243 rootCmd .AddCommand (pamCmd )
168244}
0 commit comments