Sign in and request access¶

How you sign in to kubelatch, what to ask an administrator for before you can work, and where to see the permissions you already have.

Before you start¶

You need an account. Ask for one from the team that administers kubelatch at your company (usually platform): they'll give you the URL and an invitation link. There's no self-registration.

The link grants direct access, so it must reach you over a secure channel, not open email or a public chat.

The first time: the invitation link¶

The link has the form <kubelatch-url>/cuenta#kli_.... The token comes after #, so it never reaches the logs of any server it passes through. When you open it:

1. kubelatch checks the link and clears the token from the address bar instantly.
2. If your account signs in with GitHub, you'll see Bienvenido a kubelatch (Welcome to kubelatch) and the Vincular con GitHub y entrar (Link with GitHub and sign in) button. You authorize the App and your GitHub account gets linked to your kubelatch user.
3. If there's no GitHub, you'll see a form to set your password (12 characters minimum, can't be the same as your username) and the Guardar y entrar (Save and sign in) button.

The invitation link expires after 72 hours and only works once. If you already used it or it expired, you'll see Enlace caducado o ya usado (Link expired or already used). If you reload the page after it clears the token, you'll see Enlace no válido (Invalid link). In both cases, ask for a new one. A reset link (after forgetting your password) expires after 24 hours.

The next times: how you sign in¶

Each kubelatch instance has a single sign-in method active:

• With GitHub: if your organization has a GitHub App configured, the login screen shows Entrar con GitHub (Sign in with GitHub). Only active members of that organization can sign in, with whatever two-factor requirement the organization itself enforces.
• With username and password: if there's no GitHub App configured, you see a form with Usuario (User) and Contraseña (Password), and the Entrar (Sign in) button.

If the login page shows a warning, reload it.

If an administrator has given you a break-glass account, sign in from Cuenta de emergencia (contraseña) (Break-glass account (password)).

Five wrong passwords in a row lock the account for 15 minutes. Wait, or ask an administrator to set you a new password.

What to ask an administrator for¶

Signing in isn't enough: without permissions you can't issue a useful credential. Tell your administrator exactly:

• Which cluster you need.
• Which tier:
  • viewer: read-only.
  • developer: also creates and modifies workloads.
  • debugger: also exec, attach, port-forward and ephemeral containers.
  • secrets-reader: also reads secrets.
  • admin: everything within the namespace, including roles and bindings.
  • cluster-admin: the whole cluster, at most 8 h, only for emergencies.
• Which scope: a specific namespace, or the whole cluster if the tier allows it.

For example: "I need developer and debugger in the apps namespace of the prod cluster." The detail of each tier is in Permission tiers.

The administrator grants the permission from Permisos (Permissions) (full guide). You can't grant it to yourself.

See your access¶

Sign in and go to Inicio (Home). The Mis accesos (My access) section lists every active permission: cluster, tier, scope, the group the cluster recognizes you by (kubelatch:ns:<namespace>:<tier> or kubelatch:cluster:<tier>), and when it expires. If you don't see any, you don't have permissions yet: you won't be able to issue a credential until an administrator grants you at least one.

With at least one active permission, continue to Get a credential.