Kubernetes
What this page covers
Section titled “What this page covers”Going into a container to investigate belongs in the same gateway. An asset is bound to one namespace, the pod and container are chosen at connection time, and the session keeps an immutable pod snapshot. Besides interactive exec there is a read-only log mode.
What you need
Section titled “What you need”- The address of a Kubernetes API server (port 6443 by default) and a token.
- A token holding container execution rights in the target namespace. The cluster’s own access control enforces the real authorization.
- A shell inside the container for interactive exec; for an image without one, choose another container or read the logs.
How to set it up
Section titled “How to set it up”Choose K8s as the protocol when creating the asset, and the credential field is a token. Its own fields:
- Namespace: the namespace whose pods you choose from when connecting.
- CA certificate: the API server’s CA in PEM. Left empty with verification not skipped, the system root certificates verify it.
- Skip TLS verification: an explicit per-asset switch, off by default. While it is on, the asset list and the connection screen show a warning.
An asset connectivity test sends a container execution rights precheck to the API server, and insufficient rights are reported with a clear classification.
After connecting
Section titled “After connecting”Clicking the asset brings up the pod picker first: a live list that filters by name and shows readiness, age, restart count, and image, with pod status color-coded. A pod with several containers preselects one from its annotation. Once chosen, there are two modes:
- Terminal: interactive exec.
- Logs: read-only follow, with terminal input disabled.
The toolbar shows the current namespace, pod, container, and mode; tabs are labeled by pod name, and opening the same pod again adds a sequence number.
Files move through container copy: the toolbar uploads a file to a chosen directory and downloads from the container, and both need write-level rights.
The temporary connection configuration file has narrowed permissions, the token stays out of the command line arguments, and the file is deleted when the session ends, with a sweep for leftovers at service startup.
What auditors can see
Section titled “What auditors can see”- The session keeps an immutable pod snapshot: namespace, pod name and its unique identifier, container, image, and node. Command records redundantly note the pod and container as well.
- Interactive exec goes through the same path as SSH, so command auditing, recording, live view, and blocking apply on their own.
- Log mode is recorded too, marked as log mode, with no command parsing.
- Container copy has its own audit capture with the filename, size, and direction. When policy is off, a stopped transfer leaves a refusal record with the pod, container, and path, and administrators are not exempt.