Kubernetes

Kubeconfig contexts that authenticate through a rolle session, for EKS, AKS, GKE, and clusters you run yourself.

rolle kube writes kubeconfig contexts that take their credentials from a rolle session. The kubeconfig holds no token. kubectl runs an exec plugin, and the plugin asks rolle. The context works while the session is active.

The examples use session names from rolle session list: Acme Prod/AdministratorAccess (Identity Center role), Contoso Production (Azure subscription), my-project (Google Cloud project).

Managed clusters

rolle kube list shows the EKS, AKS, or GKE clusters a started session can reach. rolle kube add writes a context for each named cluster, or for all of them with --all.

rolle start "Acme Prod/AdministratorAccess"
rolle kube list "Acme Prod/AdministratorAccess"             # NAME  LOCATION  ENDPOINT
rolle kube add "Acme Prod/AdministratorAccess" prod-eu --use # one cluster, made the current context
rolle kube add "Contoso Production" --all                    # every AKS cluster in the subscription
rolle kube add my-project web --context gke-web              # a GKE cluster under another context name
kubectl --context prod-eu get nodes

An EKS session searches its own region. --region searches another one. Without a cluster name and without --all, rolle kube add lists the clusters and exits with code 1.

Authentication

EKS. The context runs aws eks get-token with AWS_PROFILE set to the session’s profile. The AWS CLI fetches credentials through the profile and signs the token request. The AWS CLI must be installed.

AKS and GKE. The context runs rolle kube token <session>. It prints a short-lived bearer token for the cluster: an Entra ID token for the AKS server application, or the session’s Google Cloud token. The rolle command must be on your PATH. Install command in the desktop app puts it there.

Self-managed clusters

rolle kube attach sets AWS_PROFILE on a context that runs an exec plugin with AWS credentials, such as aws-iam-authenticator on a kops or kubeadm cluster:

rolle kube attach "Acme Prod/AdministratorAccess" kops-prod

For an Azure or Google Cloud session, attach replaces the context’s exec plugin with rolle kube token. Clusters that authenticate with client certificates or their own OIDC provider are not supported.

Kubeconfig file

rolle kube add and rolle kube attach edit the file named with --kubeconfig, else the first file in $KUBECONFIG, else ~/.kube/config. Entries with the same name are replaced. Every other entry and field stays. The context and cluster entries take the cluster name. An existing context keeps its namespace. The user entry is rolle:<profile>@<cluster> for AWS and rolle:<session> for Azure and Google Cloud.