https://www.vcluster.com/docs/assets/js/17c5b98c.f720505e.js

1"use strict";(self.webpackChunkvcluster_docs=self.webpackChunkvcluster_docs||[]).push([["11112"],{96639(e,t,s){s.r(t),s.d(t,{metadata:()=>r,default:()=>d,frontMatter:()=>a,contentTitle:()=>o,toc:()=>c,assets:()=>i});var r=JSON.parse('{"id":"key-features/kubectl-shell","title":"Kubectl Shell","description":"Platform administrators and users alike often find themselves in a situation where they just need to execute a couple of kubectl commands against a cluster to troubleshoot or get a specific piece of information from it.","source":"@site/vcluster_versioned_docs/version-0.35.0/key-features/kubectl-shell.mdx","sourceDirName":"key-features","slug":"/key-features/kubectl-shell","permalink":"/docs/vcluster/0.35.0/key-features/kubectl-shell","draft":false,"unlisted":false,"editUrl":"https://github.com/loft-sh/vcluster-docs/edit/main/vcluster_versioned_docs/version-0.35.0/key-features/kubectl-shell.mdx","tags":[],"version":"0.35.0","sidebarPosition":7,"frontMatter":{"title":"Kubectl Shell","sidebar_label":"Kubectl Shell","sidebar_position":7},"sidebar":"siteSidebar","previous":{"title":"Ingress Access","permalink":"/docs/vcluster/0.35.0/key-features/ingress-access"},"next":{"title":"Clean Up Obsolete Nodes","permalink":"/docs/vcluster/0.35.0/troubleshoot/clean-up-orphaned-synced-nodes"}}'),n=s(74848),l=s(28453);s(16355);let a={title:"Kubectl Shell",sidebar_label:"Kubectl Shell",sidebar_position:7},o="Kubectl shell",i={},c=[{value:"How to use",id:"how-to-use",level:2},{value:"Who can use it",id:"who-can-use-it",level:2},{value:"Security considerations",id:"security-considerations",level:2}];function u(e){let t={a:"a",code:"code",h1:"h1",h2:"h2",header:"header",p:"p",pre:"pre",...(0,l.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.header,{children:(0,n.jsx)(t.h1,{id:"kubectl-shell",children:"Kubectl shell"})}),"\n",(0,n.jsx)(t.p,{children:"Platform administrators and users alike often find themselves in a situation where they just need to execute a couple of kubectl commands against a cluster to troubleshoot or get a specific piece of information from it."}),"\n",(0,n.jsxs)(t.p,{children:["The Kubectl Shell feature is a terminal that is connected to a pod containing kubectl, among other tools. The pod exists in the target vCluster within the namespace ",(0,n.jsx)(t.code,{children:"vcluster-platform-shell"}),".\nA kubeconfig is mounted to the pod with a vCluster scoped AccessKey. This means the AccessKey cannot be used to access other resources in vCluster Platform. The Kubectl Shell Pod and AccessKey\nwill automatically be cleaned up after 15 minutes of inactivity. To learn more about the security implications and options for security hardening, read the ",(0,n.jsx)(t.a,{href:"#security-considerations",children:"Security Considerations section"}),"."]}),"\n",(0,n.jsx)(t.h2,{id:"how-to-use",children:"How to use"}),"\n",(0,n.jsx)(t.p,{children:"The Kubectl Shell feature can be accessed in the Project Overview page under the three-dot menu for any vCluster row. The Kubectl Shell feature can also be accessed on the vCluster\nConfig page under the three-dot menu."}),"\n",(0,n.jsx)(t.h2,{id:"who-can-use-it",children:"Who can use it"}),"\n",(0,n.jsxs)(t.p,{children:["Any user who has access to the VirtualClusterInstance, VirtualClusterInstances/Shell, and pod/exec permissions for the ",(0,n.jsx)(t.code,{children:"vcluster-browser-shell"})," namespace within the vCluster can use the Kubectl Shell feature.\nRead the ",(0,n.jsx)(t.a,{href:"#security-considerations",children:"Security Consideration section"})," to understand the implications of granting these aforementioned permissions."]}),"\n",(0,n.jsx)(t.p,{children:"The following YAML can be used to create a project role that grants the VirtualClusterInstance permissions needed for the Kubectl Shell feature:"}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-yaml",children:"kind: ClusterRoleTemplate\napiVersion: management.loft.sh/v1\nmetadata:\n  name: kubectlshell\n  labels:\n    loft.sh/project-role: 'true'\nspec:\n  displayName: kubectlshell\n  owner:\n    user: admin\n  management: true\n  clusterRoleTemplate:\n    metadata: {}\n    rules:\n      - verbs:\n          - '*'\n        apiGroups:\n          - management.loft.sh\n        resources:\n          - virtualclusterinstances\n          - virtualclusterinstances/shell\n"})}),"\n",(0,n.jsxs)(t.p,{children:["By default, users with VirtualClusterInstance access are granted the ",(0,n.jsx)(t.code,{children:"cluster-admin"})," ClusterRole in the vCluster, which will grant the necessary pod/exec permission for the Kubectl Shell feature. Any ClusterRole that grants\nor Role that grants the following permission will suffice instead if you configure custom RBAC settings:"]}),"\n",(0,n.jsx)(t.pre,{children:(0,n.jsx)(t.code,{className:"language-yaml",children:'rules:\n- apiGroups:\n  - ""\n  resources:\n  - pods/attach\n  - pods/exec\n  verbs:\n  - create\n'})}),"\n",(0,n.jsxs)(t.p,{children:["If using a RoleBinding and Role, you would need to target the ",(0,n.jsx)(t.code,{children:"vcluster-platform-shell"})," namespace."]}),"\n",(0,n.jsx)(t.h2,{id:"security-considerations",children:"Security considerations"}),"\n",(0,n.jsx)(t.p,{children:"Required permissions for this feature should only be given to users who are otherwise vCluster admins. vCluster admins, not to be confused with vCluster Platform admins, are any users who have full access or\neffectively full access to perform sensitive actions within the targeted vCluster."}),"\n",(0,n.jsxs)(t.p,{children:["The Kubectl Shell pods exist within the vCluster in the ",(0,n.jsx)(t.code,{children:"vcluster-platform-shell"})," namespace. The kubeconfig is mounted from a secret that also exists in the ",(0,n.jsx)(t.code,{children:"vcluster-platform-shell"})," namespace.\nAny user that has access to either exec into pods or get secrets in the ",(0,n.jsx)(t.code,{children:"vcluster-platform-shell"})," have access to the kubeconfig and the AccessKey token embedded within the kubeconfig. The AccessKey\nis scoped to the vCluster, meaning it can only be used to access vCluster related resources and cannot be used to access any other resources in the vCluster Platform. Consequently, these permissions\nshould only be granted to users who would be considered admins for the targeted vCluster. It is common for all users with access to a vCluster to effectively be admins for that vCluster. Pod exec\npermissions are a sensitive privilege and should only be given to vCluster admins regardless. Use normal Kubernetes RBAC to configure who has access to the\n",(0,n.jsx)(t.code,{children:"vcluster-platform-shell"})," namespace."]})]})}function d(e={}){let{wrapper:t}={...(0,l.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(u,{...e})}):u(e)}},16355(e,t,s){s.d(t,{A:()=>h});var r=s(74848),n=s(96540),l=s(16151),a=s.n(l),o=s(56347),i=s(80698),c=s(23652),u=JSON.parse('{"iD":"4.11.3","FQ":"0.36.3"}');let d=(e,t)=>`var-${e}-${t.toLowerCase().replace(/[^a-z0-9]/g,"-")}`,h=({code:e="",language:t="bash",title:s})=>{let l,h=(0,n.useId)(),m=(0,c.kb)(),p=(0,o.zy)(),f=u.iD,v=u.FQ;try{if(p.pathname.includes("/platform/")){let e=(0,i.zK)("platform");e?.activeVersion?.name&&"current"!==e.activeVersion.name&&(f=e.activeVersion.name)}}catch(e){}try{if(p.pathname.includes("/vcluster/")){let e=(0,i.zK)("vcluster");e?.activeVersion?.name&&"current"!==e.activeVersion.name&&(v=e.activeVersion.name)}}catch(e){}let g="string"==typeof e?e.replace(/__PLATFORM_VERSION__/g,f).replace(/__PLATFORM_VERSION_MINOR__/g,f.split(".").slice(0,2).join(".")).replace(/__VCLUSTER_VERSION__/g,v).replace(/__VCLUSTER_VERSION_MINOR__/g,v.split(".").slice(0,2).join(".")):e,b=/\[\[VAR:([^:]+):([^\]]*)\]\]/g,y={},x=new RegExp(b);if("string"==typeof g)for(;null!==(l=x.exec(g));)y[l[1]]=l[2];

1let[j,w]=(0,n.useState)(y),C="string"==typeof g?g.replace(/\[\[GLOBAL:([^\]]+)\]\]/g,(e,t)=>m[t]||`[[GLOBAL:${t}]]`).replace(b,(e,t)=>j[t]||y[t]||""):g;return 0===Object.keys(y).length?(0,r.jsx)(a(),{language:t,title:s,children:C}):(0,r.jsxs)("div",{className:"interpolated-code-wrapper",style:{marginBottom:"var(--ifm-leading)",border:"1px solid var(--ifm-color-emphasis-300)",borderRadius:"var(--ifm-code-border-radius)",backgroundColor:"rgba(0, 0, 0, 0.02)",padding:"1rem"},children:[(0,r.jsxs)("div",{className:"interpolated-code-inputs",style:{marginBottom:"1rem"},children:[(0,r.jsx)("div",{style:{fontSize:"0.8rem",color:"var(--ifm-color-emphasis-600)",marginBottom:"8px",fontStyle:"italic"},children:"Modify the following with your specific values to generate a copyable command:"}),Object.entries(y).map(([e,t])=>(0,r.jsxs)("div",{style:{display:"flex",alignItems:"center",marginBottom:"0.5rem",fontFamily:"var(--ifm-font-family-monospace)"},children:[(0,r.jsx)("label",{htmlFor:d(h,e),style:{minWidth:"150px",color:"var(--ifm-font-color-base)",fontSize:"0.9rem",fontWeight:"600",marginRight:"10px"},children:e}),(0,r.jsx)("input",{id:d(h,e),type:"text",value:j[e]||"",onChange:t=>w(s=>({...s,[e]:t.target.value})),placeholder:t,style:{backgroundColor:"rgba(255, 255, 255, 0.7)",border:"1px solid var(--ifm-color-emphasis-300)",borderRadius:"var(--ifm-global-radius)",padding:"0.3rem 0.5rem",color:"var(--ifm-font-color-base)",fontFamily:"var(--ifm-font-family-monospace)",fontSize:"0.9rem",width:"100%",outline:"none",transition:"all 0.2s ease"},onFocus:e=>{e.target.style.borderColor="var(--ifm-color-primary)",e.target.style.boxShadow="0 0 0 1px var(--ifm-color-primary)"},onBlur:e=>{e.target.style.borderColor="var(--ifm-color-emphasis-300)",e.target.style.boxShadow="none"}})]},e))]}),(0,r.jsx)("div",{children:(0,r.jsx)(a(),{language:t,title:s,children:C})})]})}},23652(e,t,s){s.d(t,{Lg:()=>i,di:()=>o,kb:()=>c});var r=s(96540);let n={},l=[],a=()=>{l.forEach(e=>e(n))},o=e=>{n={...n,...e},a()},i=(e,t)=>{n={...n,[e]:t},a()},c=()=>{let[e,t]=(0,r.useState)({...n});return(0,r.useEffect)(()=>{var e;return e=e=>{t({...e})},l.push(e),()=>{l=l.filter(t=>t!==e)}},[]),e}}}]);