---
title: Kubernetes
description: Kubeconfig contexts that authenticate through a rolle session, for EKS, AKS, GKE, and clusters you run yourself.
---

`rolle kube` writes kubeconfig contexts that take their credentials from a rolle session. The kubeconfig holds no token. `kubectl` runs an exec plugin, and the plugin asks rolle. The context works while the session is active.

The examples use session names from `rolle session list`: `Acme Prod/AdministratorAccess` (Identity Center role), `Contoso Production` (Azure subscription), `my-project` (Google Cloud project).

## Managed clusters

`rolle kube list` shows the EKS, AKS, or GKE clusters a started session can reach. `rolle kube add` writes a context for each named cluster, or for all of them with `--all`.

```sh
rolle start "Acme Prod/AdministratorAccess"
rolle kube list "Acme Prod/AdministratorAccess"             # NAME  LOCATION  ENDPOINT
rolle kube add "Acme Prod/AdministratorAccess" prod-eu --use # one cluster, made the current context
rolle kube add "Contoso Production" --all                    # every AKS cluster in the subscription
rolle kube add my-project web --context gke-web              # a GKE cluster under another context name
kubectl --context prod-eu get nodes
```

An EKS session searches its own region. `--region` searches another one. Without a cluster name and without `--all`, `rolle kube add` lists the clusters and exits with code 1.

## Authentication

**EKS.** The context runs `aws eks get-token` with `AWS_PROFILE` set to the session's profile. The AWS CLI fetches credentials through the profile and signs the token request. The AWS CLI must be installed.

**AKS and GKE.** The context runs `rolle kube token <session>`. It prints a short-lived bearer token for the cluster: an Entra ID token for the AKS server application, or the session's Google Cloud token. The `rolle` command must be on your `PATH`. **Install command** in the desktop app puts it there.

## Self-managed clusters

`rolle kube attach` sets `AWS_PROFILE` on a context that runs an exec plugin with AWS credentials, such as `aws-iam-authenticator` on a kops or kubeadm cluster:

```sh
rolle kube attach "Acme Prod/AdministratorAccess" kops-prod
```

For an Azure or Google Cloud session, `attach` replaces the context's exec plugin with `rolle kube token`. Clusters that authenticate with client certificates or their own OIDC provider are not supported.

## Kubeconfig file

`rolle kube add` and `rolle kube attach` edit the file named with `--kubeconfig`, else the first file in `$KUBECONFIG`, else `~/.kube/config`. Entries with the same name are replaced. Every other entry and field stays. The context and cluster entries take the cluster name. An existing context keeps its namespace. The user entry is `rolle:<profile>@<cluster>` for AWS and `rolle:<session>` for Azure and Google Cloud.