Kubernetes

This page explains how Kubernetes access works with Ironchip PAM. It is for whoever administers the clusters and whoever connects to them with kubectl.

How it works

The person uses kubectl with a kubeconfig that the console gives them, with a single-use ticket as the token. The Ironchip PAM broker holds each connection while Ironchip checks the window, the address and the factors, and directs it to the cluster with the resource’s credential, which the person does not know. One approval covers a whole command.

• No permanent credentials spread across laptops.
• No inbound ports. With Ironchip Connect the cluster is not published on the internet.
• Time-limited access, with a window that closes automatically.
• Recorded: every kubectl exec is recorded like a terminal, and every API request is logged. See Sessions and recordings.

How the broker signs in

When you register the resource, enter the cluster’s API URL (for example, https://10.40.50.2:6443) and choose the method: A stored token (a service account’s token), A stored client certificate or An IAM role. The console shows the commands to create the service account and its token.

Steps

1. Register the cluster as a Kubernetes resource and add it to a target policy.

2. Name that policy in an access.

3. The person requests access, if needed, and clicks Credential in PAM > My access.

4. Save the kubeconfig that the console shows and use it:

   kubectl --kubeconfig ironchip-pam.yaml get pods

   The token selects the cluster: there is nothing else to configure.