Skip to content

Get a credential

How to issue your kubelatch credential: a token for kubectl and a ready-to-use kubeconfig.

Before you start

You need at least one active permission on some cluster. If Mis accesos (My access) on Inicio (Home) is empty, request access first: see Sign in and request access.

Issue the credential

  1. Sign in to kubelatch and go to Inicio.
  2. Under Mis credenciales (My credentials), fill in the form:
  3. Nombre (Name): something to help you recognize it later (for example laptop or CI local). 100 characters max, optional.
  4. Duración (Duration): 1, 7, 30 or 90 days. A person can request at most 30 days (unless the administrator has changed that); 90 is only for bots.
  5. Cluster: leaving it at Todos los que tenga permitidos (All that I'm allowed) includes a context for every cluster where you currently have an active permission; choose a specific one to restrict the credential to that cluster.
  6. Click Emitir credencial (Issue credential).

With no active permission, the button stays disabled and you see the notice Sin permisos activos no se puede emitir ninguna credencial (Without active permissions no credential can be issued).

The token and the kubeconfig are shown only once

Once issued, the Credencial emitida (Credential issued) dialog opens with:

  • The token (klt_...), with a field to copy it.
  • The full kubeconfig, also to copy.
  • A Descargar kubeconfig (Download kubeconfig) button, which saves a kubelatch-<name-or-prefix>.yaml file.

They won't be shown again

kubelatch only stores the token's hash and its visible prefix (klt_xxxxxxxx). If you close the dialog without saving them, there's no way to recover them: issue another credential and revoke this one (see Expiry and revocation).

Duration limits

Account type Maximum duration
Person 30 days (the administrator can change this)
Bot (CI, automations) 90 days

There's no automatic renewal: when it expires, issue a new credential.

Where to save the kubeconfig

Save it to a file of its own, never overwrite your ~/.kube/config with it. Replace ~/Downloads with the folder your browser downloads to:

mkdir -p ~/.kube
mv ~/Downloads/kubelatch-laptop.yaml ~/.kube/kubelatch.yaml
export KUBECONFIG=~/.kube/kubelatch.yaml
kubectl get pods

To use it alongside your other kubeconfigs, export it only in the terminal where you work with kubelatch, or combine them in KUBECONFIG (on Windows, separate the paths with ;):

export KUBECONFIG=~/.kube/config:~/.kube/kubelatch.yaml
kubectl config get-contexts

More usage details in kubectl, k9s, Lens and Helm.

One context per cluster, fixed when issued

The kubeconfig carries a context for every cluster where you had an active permission at the moment the credential was issued. If an administrator later grants you access to a new cluster, that cluster doesn't show up in credentials already issued: issue a new credential to include it.

Check that it works

kubectl --kubeconfig ~/.kube/kubelatch.yaml get pods

If it answers with the list of pods (or an expected Forbidden depending on your tier), the credential works. If you see an error, see If something fails.