Skip to main content
A Kubernetes account lets people run kubectl against a cluster without holding a service account token. They connect through the Infisical CLI, and Infisical records each session. Kubernetes accounts don’t support browser access.

​
Prerequisites

  • The Admin role on the folder you’ll add the account to
  • A Gateway that can reach the cluster’s API server
  • kubectl on the machine of each person who connects

​
Create an account

1
Go to Privileged Access Management > Accounts and select Add Account.
2
Select the Folder to add the account to and a Kubernetes Account Template, such as the default kubernetes template, then select Next.
3
Enter a Name for the account and the cluster’s connection details:
4
Select an Auth Method and fill in its fields, as described in Authentication methods.
5
Select Create.

​
Authentication methods

With Gateway Kubernetes Auth, the account stores no token. The Gateway authenticates with its own pod’s service account and impersonates the service account you name. The Gateway’s service account needs RBAC permission to impersonate that service account.

​
Connect

To learn how to launch a session, see Connect to an account. The CLI command for the account is:
The CLI adds a context named infisical-k8s-pam/<folder>/<account> to your kubeconfig and makes it the current context, so kubectl works without any other setup:
Press Ctrl+C to end the session. The CLI then removes the context from your kubeconfig and switches back to the context you were using before.