Skip to content

Ask for access

In Pro, when you need a role you don't have, you ask for it from kubelatch itself, for a while, with a reason and a ticket: from Home, from the link a cluster's 403 carries, or with kubelatch request. The owners of the place or an administrator decide, and the permission you get ends on its own.

Where to ask from

  • Home. While you have no permission, step 2 of Your connection offers Ask for access, with "The form tells you who decides.". Each cluster of My clusters offers Ask for more, which opens the form with that cluster chosen, and each line of a permission with an end offers its way to more time (Extensions); so does Your week, for what ends in the next seven days.
  • The command palette (⌘K or Ctrl K): Ask for access.
  • The link of a 403. When the cluster refuses a request and kubelatch knows a role that would allow it, the error ends with a link that opens the form with the cluster, the namespace and the role filled in (403 — no permission). Without a session, kubelatch asks you to sign in and brings you back to the form.
  • The expiry notice. When a permission of yours ends within 24 hours, the bell and the e-mail that warn you offer Ask for an extension (or Ask for more), which opens the form with that permission chosen.
  • The terminal, with kubelatch request (kubelatch request): the same request, which waits for the decision in the terminal.

The form

Ask for access asks for six things:

  1. Cluster: the clusters enrolled in kubelatch.
  2. Where: The whole cluster, or A namespace, whose name you type. kubelatch doesn't check that the namespace exists when you ask: the approval checks it, as for any permission. A protected namespace (such as kube-system) can't be asked for.
  3. Role: the roles you can ask for on that cluster, each with its description. The one the 403 named comes first, marked What the 403 asked for, and the others wait under More roles. A role that doesn't go where you chose stays in the list, disabled, and says why: Only on the whole cluster. or Only in a namespace. No approval marks a role the cluster's environment grants at once.
  4. For: the durations that fit, starting on the one kubelatch proposes, and under them the rule that limits them, for example "prod allows at most 8 h.".
  5. Reason: always required. The person who decides reads it.
  6. Ticket: a link, or a key such as INC-123. Optional, unless the cluster's environment asks for one: the field then says so ("· required in prod"). When your kubelatch links keys to your team's tracker, the form shows the link the ticket will be.

Beside the form, Who decides names who is asked to decide the request, or says that the environment grants the role without approval. In Pro a place can have owners: the request asks the namespace's owners, else the cluster's, else its environment's, and an administrator can decide it too; with no owners, the administrators decide. A request for cluster-admin, a native role or a privileged role always waits for an administrator. You already have here lists your permissions on that cluster, with where each comes from.

The button says what will happen: "Ask for debugger in pagos for 2 h", "Ask for viewer on all of prod for 8 h", or "Get viewer in web for 8 h" when the environment grants that role without approval. While something is missing, the button says what under itself.

Sending opens the request's page, where you see who decides and how it stands. If the same request (same cluster, role and place) was already waiting, kubelatch doesn't file another one: it opens the one that waits.

If nobody else can decide it, for example because you are the only administrator and nobody else owns the place, the form says Nobody else can decide it. An administrator grants it in Permissions instead: Grant it to yourself in Permissions leads there.

How long you can ask for

The time counts from the approval, not from the request. A request asks for 15 minutes at least, and at most the smallest of:

  • the maximum the cluster's environment allows a person's permission;
  • the role's own maximum: cluster-admin lasts 8 hours at most;
  • 30 days.

A request never asks for a permission without an end: a permanent one is granted by an administrator in Permissions. Whoever decides can shorten what you asked for, never lengthen it.

Extensions

A request for the role and the place of a direct permission of yours that has an end is an extension: once approved, it adds its time to the permission's end instead of creating another one. The form says so before you send it, "This is an extension: your permission ends on 12 Nov, 18:00; with 2 h more it would end on 12 Nov, 20:00.", For offers what an extension can still add, with the rule under it ("An extension can now add at most 6 h."), and the button says it: "Ask for 2 h more of debugger in shop".

An extension follows the limits of a permission extended by hand: the new end stays within the environment's maximum counted from now, and the 8 hours of cluster-admin count from when the permission was created. A permission that can take no more time says "This permission takes no more time. Ask for a new one once it ends.", and one without an end, "You already have this permission, with no end.": neither can be asked for.

On Home, each line of a permission with an end offers Ask for an extension, beside Copy command, and so does its box in Your week. A permission you get through a group or a set can't be extended: its line offers Ask for more, a new request for the same role and place. What expired this week leads to Ask for access.

A request's life

  • It waits 24 hours for a decision. After that it expires, and you can ask again.
  • You can have at most 20 requests waiting at once.
  • While it waits, you can cancel it: from Home, from its page, or with kubelatch request cancel <id>.

My requests, on Home, lists your requests that wait, with how long ago you asked and Cancel, and the ones closed in the last 24 hours: approved, denied, expired or cancelled, with who decided (or the environment's rule), until when the permission lasts, and the note they left for you. See all opens all of them.

After the approval

The permission shows up in My clusters, and its line says where it comes from: by request, a link to the request, then who approved it (approved by luis) or without approval when the cluster's environment granted it; a permission the request made longer says extension in its place. It lasts what was approved and ends on its own, like any other permission (Expiry and revocation). If the cluster is new to you, get its context with kubelatch kubeconfig (The CLI) or a new credential (Get a credential).

A denied request carries the note of the person who denied it.

In Free

There is no form: step 2 of Your connection and the request page say whom to ask, the contact your administrators set up or, without one, the oldest administrator, and the 403 names them too. The requests and approvals of AI agents work as always (AI agents).