Skip to content

Tenant Kubernetes clusters

If your contract includes a managed Kubernetes cluster, you manage your access to it from the portal: issue your own kubeconfig credentials, and (if you are a customer admin) request changes and manage who else can use the cluster.

Clusters are provisioned by Sunet operators. The portal does not create clusters; it gives you self-service control over an existing one. For how to actually use a cluster once you are connected, see the Kubernetes section.

Finding your clusters

Clusters appear in two places:

  • On a contract page (My Contracts then a contract), scoped to that contract.
  • Under All clusters, across every contract you have access to.

Each cluster shows whether it is provisioned or still pending, its size, the number of servers (3 controllers plus 3 workers per worker group), and your role on it.

Roles

Your role on a cluster determines what you can do:

  • user: issue and manage your own kubeconfig credentials.
  • customer admin: everything a user can do, plus manage cluster users and request changes on behalf of your organization.

Sunet operators hold a further admin role used for provisioning and for appointing customer admins.

Kubeconfig credentials

Credentials are self-service. The portal issues a personal kubeconfig scoped to your access on the cluster; you can hold several (for example one per machine) and rotate or revoke them independently.

Credential issuance is only available once the cluster is provisioned.

Issuing a kubeconfig

In a cluster's My credentials section:

  1. Give the credential a label (for example laptop) so you can tell your credentials apart.
  2. Optionally set a TTL in days. If you leave it blank the credential is valid for 365 days.
  3. Choose Issue kubeconfig.

The kubeconfig is shown once, in a dialog, with a Download button.

The kubeconfig is shown only once

Save or download the file immediately. It is not stored and cannot be retrieved again later. If you lose it, rotate the credential to get a new one.

Rotating and revoking

For each active credential you can:

  • Rotate: issue a fresh kubeconfig under the same label. The previous one stops working immediately, so use this if a credential might be compromised or you simply lost the file.
  • Revoke: disable the credential immediately and for good.

Credentials also show their issue and expiry dates, and warn you when one is within 30 days of expiring.

Requesting changes

Customer admins can request changes to the cluster from its Request a change section. A request notifies Sunet operators by email and is applied (or denied) by them; you can follow its state in the Request history on the same page. Available requests:

  • JupyterHub add-on: enable JupyterHub on the cluster.
  • Resize: increase the number of worker groups. You can only request a larger size than the current one.
  • Backup: enable or disable backup for the cluster.

Only one request of each kind can be pending at a time.

Managing cluster users

Customer admins manage who can use the cluster from Manage users:

  • Add a user by their federated identifier and assign a role. Customer admins can grant the user role; only Sunet operators can appoint other customer admins.
  • Remove a user. Removing someone also revokes every kubeconfig they have issued on that cluster.