Get a credential¶

How to issue your kubelatch credential: a token for kubectl and a ready-to-use kubeconfig.

Before you start¶

You need at least one active permission on some cluster. If My clusters on Home is empty, request access first: see Sign in and request access.

If you work from a terminal, the kubelatch CLI is simpler: it signs you in from the browser and keeps the credential for you (the Your connection card on Home gives you the exact login command, and so does Sign in with the CLI, in the line under the title, while you work with a credential). This page is for when you want the kubeconfig with the token inside.

Issue the credential¶

1. Sign in to kubelatch and go to Home.
2. Click Issue a credential, in the My credentials card. To start from one cluster, click New kubeconfig… on its row under My clusters instead: the form opens with that cluster chosen. The Issue a credential form opens in a panel on the right (full width on a phone); fill it in:
3. Name: how you will recognize it later (for example laptop or local CI). Required, 100 characters max.
4. Duration: 1, 7 or 30 days for a person; a bot gets up to 90. If your administrator set a different maximum, only the durations that fit are offered, plus that maximum itself. The shortest one is chosen for you.
5. Cluster: leaving it at All clusters with an active permission includes a context for every cluster where you currently have an active permission; choose a specific one to restrict the credential to that cluster. With a permission on a single cluster, the form just names it.
6. Note (optional): up to 500 characters.
7. Under the fields, a sentence says what you are about to issue, for example Credential laptop for kind-local, 7 days, with viewer in default and admin in apps. Click Issue credential.

With no active permission, the form gives way to the notice Without active permissions no credential can be issued. and the way to ask for access.

The token and the kubeconfig are shown only once¶

Once issued, the Credential issued dialog shows first the kubeconfig: a Download kubeconfig button, a Test command ready to copy and run (run it in the folder where you saved the file), and the list of contexts it carries. Below comes the full kubeconfig text, with a copy button (on a narrow screen it's folded under Show the kubeconfig: downloading it is the way). The raw token (klt_...) is folded under Token only (Bearer): for Lens or a script, for the rarer case where you need the bearer token itself rather than a kubeconfig.

If you try to close the dialog before copying or downloading anything, it warns you: You have not saved it yet. Close again to discard it. The downloaded file is named kubelatch-<name>.yaml, after your credential's name.

Duration limits¶

There's no automatic renewal: when it expires, issue a new credential.

Where to save the kubeconfig¶

Save it to a file of its own, never overwrite your ~/.kube/config with it. Replace ~/Downloads with the folder your browser downloads to:

mkdir -p ~/.kube
mv ~/Downloads/kubelatch-laptop.yaml ~/.kube/kubelatch.yaml
export KUBECONFIG=~/.kube/kubelatch.yaml
kubectl get pods

To use it alongside your other kubeconfigs, export it only in the terminal where you work with kubelatch, or combine them in KUBECONFIG (on Windows, separate the paths with ;):

export KUBECONFIG=~/.kube/config:~/.kube/kubelatch.yaml
kubectl config get-contexts

More usage details in kubectl, k9s, Lens and Helm.

One context per cluster, fixed when issued¶

The kubeconfig carries a context for every cluster where you had an active permission at the moment the credential was issued, named kubelatch-<cluster> like the CLI's. If an administrator later grants you access to a new cluster, that cluster doesn't show up in credentials already issued: issue a new credential to include it.

Check that it works¶

kubectl --kubeconfig ~/.kube/kubelatch.yaml get pods

If it answers with the list of pods (or an expected Forbidden depending on your tier), the credential works. If you see an error, see If something fails.