# Kubernetes

> Give privileged access to Kubernetes clusters with kubectl and a single-use ticket, with no permanent credentials handed out and with recorded sessions.

URL: https://docs.ironchip.com/en/pam/recursos/kubernetes/

This page explains how Kubernetes access works with Ironchip PAM. It is for whoever administers the clusters and whoever connects to them with `kubectl`.

## How it works

The person uses `kubectl` with a `kubeconfig` that the console gives them, with a single-use ticket as the token. The Ironchip PAM broker holds each connection while Ironchip checks the window, the address and the factors, and directs it to the cluster with the resource's credential, which the person does not know. One approval covers a whole command.

- **No permanent credentials** spread across laptops.
- **No inbound ports.** With [Ironchip Connect](https://docs.ironchip.com/en/pam/conceptos/arquitectura/#ironchip-connect) the cluster is not published on the internet.
- **Time-limited access**, with a window that closes automatically.
- **Recorded:** every `kubectl exec` is recorded like a terminal, and every API request is logged. See [Sessions and recordings](https://docs.ironchip.com/en/pam/administracion/sesiones/).

## How the broker signs in

When you register the resource, enter the cluster's API **URL** (for example, `https://10.40.50.2:6443`) and choose the method: **A stored token** (a service account's token), **A stored client certificate** or **An IAM role**. The console shows the commands to create the service account and its token.

## Steps

1. Register the cluster as a Kubernetes [resource](https://docs.ironchip.com/en/pam/administracion/recursos/) and add it to a [target policy](https://docs.ironchip.com/en/pam/administracion/politicas/#target-policies).
2. Name that policy in an [access](https://docs.ironchip.com/en/pam/administracion/accesos/).
3. The person [requests access](https://docs.ironchip.com/en/pam/usuarios/solicitar-acceso/), if needed, and clicks **Credential** in **PAM > My access**.
4. Save the `kubeconfig` that the console shows and use it:

   ```bash
   kubectl --kubeconfig ironchip-pam.yaml get pods
   ```

   The token selects the cluster: there is nothing else to configure.