Skip to content

cub target access

cub target access

Get temporary kubectl access to a cluster

Synopsis

Request temporary kubectl access by invoking the generate-kubecontext function on an access policy unit applied to a target. The unit must contain a ServiceAccount with the confighub.com/generate-kubecontext: allow annotation and must have been applied to the target. The function runs on the worker named by --worker, which must be running in the cluster.

The resulting kubeconfig is encrypted end-to-end — the ConfigHub server never sees the credentials.

cub target access <target-slug> <access-config-unit-slug> [flags]

Options

  -h, --help            help for access
      --output string   write kubeconfig to this file instead of stdout
      --ttl string      requested token TTL (e.g., 30m, 1h); capped by the policy's max-ttl
      --worker string   slug or ID of the worker running in the cluster, which runs generate-kubecontext

Options inherited from parent commands

      --component string   the Component of --variant, when that names the variant alone; --variant <component>/<variant> says the same in one flag
      --context string     The context to use for this command
      --debug              Debug output
      --space string       space to operate in, by slug or UUID. Omitted, a list or bulk operation spans the organization and a single entity is named as <space>/<slug>
      --variant string     variant to operate in, as <component>/<variant>, or as <variant> with --component: the space naming that Component whose Variant label is <variant>. The same scope as --space, named by what it is rather than by the space's slug; the two cannot be combined

SEE ALSO