|
1 | 1 | --- |
2 | 2 | meta: |
3 | | - title: How to connect to a cluster with kubectl |
| 3 | + title: How to connect to a Kubernetes Kapsule cluster with kubectl |
4 | 4 | description: Learn how to connect to a Kubernetes cluster using kubectl. Follow steps to manage cluster resources, deploy applications, and view logs easily from your local computer. |
5 | 5 | content: |
6 | | - h1: How to connect to a cluster with kubectl |
7 | | - paragraph: This page explains how to connect to a Kubernetes cluster via kubectl |
| 6 | + h1: How to connect to a Kubernetes Kapsule cluster with kubectl |
| 7 | + paragraph: This guide details the steps to connect to a Kubernetes cluster using kubectl, the Kubernetes command-line tool. |
8 | 8 | tags: connection cluster kubectl |
9 | 9 | dates: |
10 | | - validation: 2024-11-18 |
| 10 | + validation: 2025-01-27 |
11 | 11 | posted: 2020-09-20 |
12 | 12 | categories: |
13 | 13 | - kubernetes |
14 | 14 | --- |
15 | 15 |
|
16 | | -Once your [cluster is created](/kubernetes/how-to/create-cluster/), a `.kubeconfig` file is available for download to manage several Kubernetes clusters. You can use this with `kubectl`, the Kubernetes command line tool, allowing you to run commands against your Kubernetes clusters. You can use `kubectl` from a terminal on your local computer to deploy applications, inspect and manage cluster resources, and view logs. |
| 16 | +Once your [cluster is created](/kubernetes/how-to/create-cluster/), you can install a `kubeconfig` file using Scaleway's command-line tool on your local machine to manage your Kubernetes cluster. |
| 17 | + |
| 18 | +You can use this with `kubectl`, the Kubernetes command-line tool, allowing you to run commands against your Kubernetes cluster. This enables you to deploy applications, inspect and manage cluster resources, and view logs directly from your local machine. |
17 | 19 |
|
18 | 20 | <Macro id="requirements" /> |
19 | 21 |
|
20 | | -- A Scaleway account logged into the [console](https://console.scaleway.com) |
21 | | -- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Organization |
22 | | -- Created a [Kubernetes Kapsule cluster](/kubernetes/how-to/create-cluster/) |
| 22 | +- A [Scaleway account](https://console.scaleway.com) logged into the console. |
| 23 | +- [Owner status](https://console.scaleway.com) or [IAM permissions](/iam/concepts/#permission) to perform actions in the intended Organization. |
| 24 | +- Created a [Kubernetes Kapsule cluster](/kubernetes/how-to/create-cluster/). |
| 25 | +- [kubectl](https://kubernetes.io/docs/tasks/tools/) installed locally. |
| 26 | +- The [Scaleway CLI](/scaleway-cli/quickstart/) installed locally. |
| 27 | + |
| 28 | +## Setting fine-grained permissions (IAM Policies) for Kubernetes access |
| 29 | + |
| 30 | +If your Organization uses IAM to control access, ensure that you or your group/application has the following permission sets assigned at the Project scope: |
| 31 | + |
| 32 | +- `KubernetesFullAccess` (or `KubernetesReadOnly`, depending on your needs): |
| 33 | + Grants you the ability to manage (or list/read) Kubernetes clusters, nodes, and related actions in your Scaleway Project. |
| 34 | + |
| 35 | +To create a new policy with the correct permission sets, follow these steps: |
| 36 | + |
| 37 | +### Configure an IAM policy |
| 38 | + |
| 39 | +1. **Create a new policy**: Navigate to the **Policies** tab in your Organization’s IAM console and create a new policy. |
| 40 | +2. **Add your user (or group/application)**: Assign your user, group, or application as the **Principal**. |
| 41 | +3. **Add an IAM rule**: |
| 42 | + - **Scope**: Set to **Access to resources** and specify the desired Project(s). |
| 43 | + - **Permission Sets**: Include the following as needed: |
| 44 | + - `KubernetesFullAccess` for full cluster management. |
| 45 | + - `KubernetesReadOnly` for read-only access. |
| 46 | +4. Click **Validate** and then **Create Policy**. |
| 47 | + <Message type="tip"> |
| 48 | + - Refer to our [policy and permission sets documentation](/iam/reference-content/permission-sets/) for more details. |
| 49 | + - Scaleway may **automatically generate IAM resources**, such as applications, groups and policies. Refer to [auto-generated IAM resources](/iam/reference-content/auto-generated-iam-resources/) for further information. |
| 50 | + </Message> |
| 51 | + |
| 52 | +## Accessing the cluster |
| 53 | + |
| 54 | +You can use the Scaleway CLI to automatically retrieve (and merge) your `kubeconfig` file, then interact with your Kubernetes cluster. |
| 55 | + |
| 56 | +### Install and configure the Scaleway CLI |
| 57 | + |
| 58 | +If you have not set up the Scaleway CLI yet: |
| 59 | + |
| 60 | +1. Follow our [installation guide](/scaleway-cli/quickstart) for platform-specific instructions using Homebrew, Chocolatey, or manual methods. |
| 61 | +2. Run the following command and follow the prompts to set up your CLI with your Scaleway API keys: |
| 62 | + ```bash |
| 63 | + scw init |
| 64 | + ``` |
| 65 | + You will need your [API Key](/iam/how-to/create-api-keys/) (access key and secret key). |
| 66 | + |
| 67 | + |
| 68 | +### Retrieve and install the kubeconfig using scw |
| 69 | + |
| 70 | +1. Run the following command to install the `kubeconfig` file for your cluster: |
| 71 | + ```bash |
| 72 | + scw k8s kubeconfig install <cluster-id> |
| 73 | + ``` |
| 74 | + This command will: |
| 75 | + - Download the `kubeconfig` for the specified cluster. |
| 76 | + - Merge it into your existing `kubeconfig` file (default location: `~/.kube/config`). |
| 77 | + |
| 78 | +2. Verify the installation: |
| 79 | + ```bash |
| 80 | + kubectl get nodes |
| 81 | + ``` |
| 82 | + A list of nodes from your Kapsule cluster should appear. |
| 83 | + |
| 84 | +<Message type="tip"> |
| 85 | + Refer to our complete [Documentation for `scw k8s`](https://github.com/scaleway/scaleway-cli/blob/master/docs/commands/k8s.md) to learn more about all available commands to manage your Kubernetes cluster using `scw`. |
| 86 | +</Message> |
| 87 | + |
| 88 | + |
| 89 | +## Revoking user access to the Kubernetes cluster |
| 90 | + |
| 91 | +When a user loses access rights (e.g., departs from the Organization), the Kubernetes administrator must take steps to revoke their access to the cluster. |
| 92 | +This is typically done by modifying IAM settings, such as adjusting policies or deleting the user’s credentials. |
| 93 | + |
| 94 | +### Steps to revoke access |
| 95 | + |
| 96 | +To revoke a user's access to the cluster, ensure that any API keys associated with the user are no longer granted permission. Here are the steps you can take: |
| 97 | + |
| 98 | +#### Delete the API key |
| 99 | + - Locate the API key associated with the user. |
| 100 | + - Remove the key to immediately revoke access. |
| 101 | + |
| 102 | +#### Modify IAM policies |
| 103 | + - Adjust the IAM policy linked to the API key to limit or remove its permissions. |
23 | 104 |
|
24 | | -1. [Install kubectl](https://kubernetes.io/docs/tasks/tools/) on your local computer. |
25 | | -2. Download the `.kubeconfig` files from your cluster's **overview** page: |
26 | | - <Lightbox src="scaleway-kapsule_kubeconfig.webp" alt="" /> |
27 | | -3. Configure access to your cluster. You can do this in one of two ways: |
| 105 | +#### Reassign the user to a restricted group |
| 106 | + - Transfer the principal (application or user) to a group with reduced permissions that does not allow cluster access. |
28 | 107 |
|
29 | | - Set the `KUBECONFIG` environment variable: |
30 | | - ``` |
31 | | - export KUBECONFIG=/$HOME/Downloads/Kubeconfig-ClusterName.yaml |
32 | | - ``` |
| 108 | +#### Delete the principal |
| 109 | + - Permanently remove the user or application from the IAM system to ensure no further access is possible. |
33 | 110 |
|
34 | | - Or use `use $HOME/.kube/config file`: |
35 | | - ``` |
36 | | - mv $HOME/Downloads/Kubeconfig-ClusterName.yaml $HOME/.kube/config |
37 | | - ``` |
| 111 | +### Revoking kubeconfig access |
38 | 112 |
|
39 | | - Either way, make sure you replace `/$HOME/Downloads/Kubeconfig-ClusterName.yaml` with the correct name and path of your downloaded `.kubeconfig` file. |
40 | | -4. Run the following command to finish: |
41 | | - ``` |
42 | | - kubectl get nodes |
43 | | - ``` |
| 113 | +To permanently revoke `kubeconfig` access via IAM: |
44 | 114 |
|
| 115 | +- **Delete the API Key**: This will ensure that the user's `kubeconfig` file becomes invalid immediately. |
| 116 | +- **Delete the Principal**: Removing the user or application guarantees that no further access can be gained, even if residual configurations exist. |
45 | 117 |
|
| 118 | +<Message type="note"> |
| 119 | + - Be cautious when modifying IAM policies to avoid unintended access issues for other users or services. |
| 120 | + - Regularly audit IAM settings and API keys to ensure compliance with organizational security policies. |
| 121 | +</Message> |
0 commit comments