Comment on page
Configure access to your K8s cluster
Learn how to create access controls and view your cluster using kubectl, K9s, and eksctl
This document walks you through giving a user access to a Release EKS cluster, accessing the cluster, and viewing the cluster using K9s and
- AWS: Amazon Web Services
- IAM: Identity and Access Management
- EKS: Elastic Kubernetes Service
- ARN: Amazon Resource Name
To add an IAM user to your cluster, you will need the following:
- Administrator privileges to the EKS cluster.
- The ARN for the user you're granting access to (looks like
You can grant a user access to a cluster in two ways: Using the K9s visual editor or the command line.
- 1.Start up K9s and use the
:namespacecommand to access the
kube-systemnamespace as shown below:
- 2.Use the
:configmapcommand to access the
aws_authand hit the
editthe file. Insert the user as shown below:
- 4.Copy and paste the section outlined in red above to create a new user. Be careful to edit the ARN correctly to allow the user to access the system. In this example, the users are administrators, but you can consult the documentation for Kubernetes to define default roles like viewers and ops users.
- 5.Save the file and then verify the changes by using the
d(describe) command to view the document that was applied.
- 1.Download the existing
aws_authconfigmap from the
- 2.Edit the
mapUsersfield and add the user.
- 3.Save the file.
- 4.Apply the changes to the cluster.
- 5.Verify the changes have been made.
To access the cluster once you have been added to the configmap, you'll need:
Once you have been added to the cluster configmap and you have the prerequisites installed, you can gain access to the cluster to view status and logs, and to perform other tasks you have permissions for.
Have your AWS credentials available in configuration files, in your environment variables, or in named profiles.
Follow the steps in the AWS configuration basics guide. The
eksctlbinary respects the usual configuration directives that the AWS CLI uses. This document assumes the default credentials are available. If you wish to specify a set of credentials other than default, you will need to specify them appropriately.
Your credentials will authenticate you as a user or role in the account and region where the EKS cluster is available. You may have a user role configured in a different account and then assume a role in the EKS cluster account, or you may have a very complicated setup with OAuth or SAML integrations, which is beyond the scope of this document.
To generate your kubeconfig file, type the following where your
eksctlbinary is available and your AWS credentials are specified by default:
eksctl utils write-kubeconfig --cluster CLUSTERNAME --region REGION
We recommend that you use the K9s interface for visualization and viewing logs and status. Administrating the cluster from the K9s interface is also possible. Here are a few use cases we’ve found useful.
View application namespaces
You can use the
:namespacescommand and filter with the
/releasesearch to list applications running from Release environments as shown below:
View pods for a Release environment
You can then either click on a namespace or type the
:podscommand to view the applications in the Release environment as shown below:
View logs for an application container in a Release environment
You can use the
l(or logs) command to view what is happening in your application:
Access the container system (if available)
If you have sufficient privileges and configuration, use the
s(or shell) command to enter the running container, if available:
Use the familiar VI controls to
:quitthe K9s application:
Use CLI commands to examine the state of the cluster, but we generally don't recommend using them to change settings or start or stop pods or services, as this should be handled by the Release website or CLI tool.
kubectl get namespaces
Remember that a namespace in Kubernetes maps to a Release environment.
kubectl get pods -n RELEASEENV
Remember that a pod in Kubernetes maps to a Release service in the environment.
kubectl get logs RELEASESERVICE