Skip to content

Tenant Kubernetes clusters

If your contract includes a managed Kubernetes cluster, you manage your access to it from the portal: issue your own kubeconfig credentials, and (if you are a customer admin) request changes and manage who else can use the cluster.

Clusters are provisioned by Sunet operators. The portal does not create clusters; it gives you self-service control over an existing one. For how to actually use a cluster once you are connected, see the Kubernetes section.

Finding your clusters

Clusters appear in two places:

  • On a contract page (My Contracts then a contract), scoped to that contract.
  • Under All clusters, across every contract you have access to.

Each cluster shows whether it is provisioned or still pending, its size, the number of servers (3 controllers plus 3 workers per worker group), and your role on it.

Roles

Your role on a cluster determines what you can do:

  • user: issue and manage your own kubeconfig credentials.
  • customer admin: everything a user can do, plus manage cluster users and request changes on behalf of your organization.

Sunet operators hold a further admin role used for provisioning and for appointing customer admins.

These are portal roles. They control who can issue credentials and manage users in the portal; they do not create separate Argo CD roles. See Connecting to your cluster for the current Argo CD administrator-access model.

Kubeconfig credentials

Credentials are self-service. The portal issues a personal kubeconfig scoped to your access on the cluster; you can hold several (for example one per machine) and rotate or revoke them independently.

Credential issuance is only available once the cluster is provisioned.

Issuing a kubeconfig

In a cluster's My credentials section:

  1. Give the credential a label (for example laptop) so you can tell your credentials apart.
  2. Optionally set a TTL in days. If you leave it blank the credential is valid for 90 days.
  3. Choose Issue kubeconfig.

The kubeconfig is shown once, in a dialog, with a Download button.

The kubeconfig is shown only once

Save or download the file immediately. It is not stored and cannot be retrieved again later. If you lose it, rotate the credential to get a new one.

Rotating and revoking

For each active credential you can:

  • Rotate: issue a fresh kubeconfig under the same label. The previous one stops working immediately, so use this if a credential might be compromised or you simply lost the file.
  • Revoke: disable the credential immediately and for good.

Credentials also show their issue and expiry dates, and warn you when one is within 30 days of expiring.

Requesting an Argo CD DNS alias

Customer admins can use the optional Argo CD DNS alias field to record the hostname they want to use for the Argo CD web interface. For example, enter argocd.example.org, then create this record in the DNS zone for example.org:

argocd.example.org. CNAME argocd.<cluster-slug>.k8s-prod.sunetvdc.se.

Replace <cluster-slug> with the slug shown in the portal. Do not create an A or AAAA record for the alias. The CNAME follows the platform-managed target if its addresses change, while an A or AAAA record would become stale.

Saving the field records metadata and your requested desired state only. It does not create or validate the DNS record, and it does not activate routing or TLS. Keep the CNAME in place so it is ready before SUNET activates the alias through the Gateway and cert-manager in a future delivery step.

This alias applies only to the Argo CD web interface. Kubernetes API access continues to use the canonical SUNET-managed hostname in your kubeconfig.

Requesting changes

Customer admins can request changes to the cluster from its Request a change section. A request notifies Sunet operators by email and is applied (or denied) by them; you can follow its state in the Request history on the same page. Available requests:

  • JupyterHub add-on: enable JupyterHub on the cluster.
  • Resize: increase the number of worker groups. You can only request a larger size than the current one.
  • Backup: enable or disable backup for the cluster.

Only one request of each kind can be pending at a time.

Managing cluster users

Customer admins manage who can use the cluster from Manage users:

  • Add a user by their federated identifier and assign a role. Customer admins can grant the user role; only Sunet operators can appoint other customer admins.
  • Remove a user. Removing someone also revokes every kubeconfig they have issued on that cluster.