Skip to main content
Use this runbook when you need time-limited kubectl or k9s access to a Fleet Manager production Kubernetes cluster. Request only the cluster, role, and duration required for the work, and drop the access when you finish.
Production access is privileged. Do not use a production cluster for routine development or testing. Confirm the target cluster and namespace before running a mutating command.

​
Before You Begin

  • Install the Teleport CLI (tsh), kubectl, and, if needed, k9s.
  • Know the production cluster and the minimum Kubernetes role your work needs.
  • Have a concise reason ready, including the Fleet Manager task or incident and the intended operation.

​
1. Log In to Teleport

Authenticate with your nscale Google account. You normally need to do this once per local Teleport session. If you already have a regular Teleport session, continue to the request flow; you still need to assume the approved request in Step 3.

​
2. Create a Temporary Access Request

  1. Open Teleport and select Identity Governance then Access Requests.
  2. Select New Access Request. Teleport Access Requests with the New Access Request button
  3. Search for the Fleet Manager cluster, then select the required production cluster. Check its env: prod and region labels before continuing; similarly named development and production resources are listed together. Fleet Manager production Kubernetes clusters in Teleport
  4. Select Proceed to Request. Teleport Proceed to Request button after selecting a resource
  5. Choose Temporary access and select only the roles required for the task:
    • nscale-k8s-viewer for read-only inspection.
    • nscale-k8s-editor when the task requires changing application resources.
    • nscale-k8s-admin only when the task explicitly requires administrator privileges.
    The screenshot below intentionally selects only nscale-k8s-viewer. The exact permissions of these roles are platform-managed; if none maps clearly to the task, ask the Fleet Manager team before requesting broader access.
  6. Set the shortest practical duration. In Request Reason, state the Fleet Manager issue or incident, the target cluster, and the operation you will perform. Do not include secrets.
  7. Select Submit Request. Temporary request form with roles, duration, and request reason
Wait for the request to be approved. The Teleport notification or request page displays the request ID and approval status. If a request is not auto-approved, ask in #cnp-re-chat. If it should have been auto-approved, raise a request in gcloud-iac. Approved Teleport request notification, including its request ID

​
3. Assume the Approved Request and Log In to Kubernetes

Replace the placeholders with the approved request ID and the exact cluster name you selected:
Confirm that kubectl is using the intended cluster before doing any work:
You can now use kubectl or k9s within the role and duration granted by the request.

​
4. Return to Regular Access When You Finish

Drop the request from your current local identity as soon as the task is complete:
This returns the local tsh session to regular access. It does not cancel or revoke the approved request: it remains assumable until its expiry. If access must be revoked earlier, contact the access-request approver or a Teleport administrator. If you need further access later, create a new temporary request with a new reason. Never use another person’s credentials.