Connect with kubectl

Every Andromeda cluster runs Kubernetes, including clusters that run Slurm. You fetch a kubeconfig for the cluster from the Platform API, and kubectl signs you in to the cluster’s Kubernetes API with your own Andromeda account.

Before you start

You need:

The clusters.kubernetes organization permission, clusters.kubernetes.admin for full control, or a Kubernetes resource grant naming this cluster or a namespace in it. See Permissions.
ORG_ID and CLUSTER_ID set as in the quickstart.
kubectl.
The kubelogin plugin, which adds kubectl oidc-login. Install it with Homebrew (brew install kubelogin) or krew (kubectl krew install oidc-login).

Check the plugin is installed:

kubectl oidc-login --help

If you are outside the owning organization, use the granted cluster ID and the owning organization ID supplied by the person sharing it; see Access to a shared cluster.

Fetch the kubeconfig

mkdir -p ~/.kube
andromeda call platform GET "/clusters/$CLUSTER_ID/kubeconfig?organizationId=$ORG_ID" |
  jq -r .kubeconfig > ~/.kube/andromeda-$CLUSTER_ID.yaml
export KUBECONFIG=~/.kube/andromeda-$CLUSTER_ID.yaml

The kubeconfig holds no credentials, so you can keep it anywhere and share it with other members of your organization. Each person signs in as themselves. The cluster, context, and user in it are all named after the cluster ID. Run a kubectl command allowed by your access. Set NAMESPACE to a namespace your grant or organization permission covers, then list its pods:

kubectl get pods -n "$NAMESPACE"

The first time, kubectl oidc-login prints a URL and a code. Open the URL, sign in with your Andromeda account, and enter the code. The plugin caches the token, so later commands run without prompting until it expires.

NAME       READY   STATUS    RESTARTS   AGE
trainer    1/1     Running   0          5m

What you can do

Permission	Kubernetes role
`clusters.kubernetes`	`edit` in every namespace: create and change most workload resources, but not roles or role bindings.
`clusters.kubernetes.admin`	`cluster-admin`: full control of the cluster.

Resource grants use kubernetes.viewer, kubernetes.developer, or kubernetes.admin. They map to view, edit, and admin within a granted namespace; a whole-cluster kubernetes.admin grant maps to cluster-admin. A custom role can narrow these further. The kubeconfig itself gives no permissions, so with a namespace grant you may not be able to list nodes or other namespaces. If your grant has an expiry, the kubeconfig response includes it as accessExpiresAt. When the grant expires or is revoked, your access ends as the cluster applies the change, even if kubectl still holds a cached sign-in. On a Slurm cluster, Slurm and the components Andromeda manages also run in Kubernetes. Changing them with cluster-admin can break the cluster; use the Slurm configuration API to change Slurm.

Troubleshooting

Symptom	Cause and fix
The kubeconfig request returns `403`	You have neither an applicable organization permission nor a live Kubernetes resource grant. See Permissions.
The kubeconfig request returns `409`	The cluster is not `active` yet, or its Kubernetes API is not ready. Check cluster options and try again.
The kubeconfig request returns `503` with `customer_kubernetes_login_not_configured`	This environment does not offer Kubernetes sign-in. Contact Andromeda Support.
`kubectl` says `oidc-login` is not a command	Install kubelogin, above.
`kubectl` returns `Forbidden`	The action or namespace is outside your role, your grant expired or was revoked, or the permission update has not reached the cluster yet.

Reference

GET /clusters/{clusterId}/kubeconfig

Get started

Guides

Before you start

Fetch the kubeconfig

What you can do

Troubleshooting

Reference

​Before you start

​Fetch the kubeconfig

​Sign in

​What you can do

​Troubleshooting

​Reference

Before you start

Fetch the kubeconfig

Sign in

What you can do

Troubleshooting

Reference