> ## Documentation Index
> Fetch the complete documentation index at: https://docs.internal.nscale.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Temporary Production Cluster Access
> Request, use, and drop time-limited Kubernetes access for Fleet Manager production work.
Use this runbook when you need time-limited `kubectl` or `k9s` access to a Fleet Manager
production Kubernetes cluster. Request only the cluster, role, and duration required for the
work, and drop the access when you finish.
Production access is privileged. Do not use a production cluster for routine development
or testing. Confirm the target cluster and namespace before running a mutating command.
## Before You Begin
* Install the [Teleport CLI](https://goteleport.com/docs/connect-your-client/teleport-connect/)
(`tsh`), `kubectl`, and, if needed, `k9s`.
* Know the production cluster and the minimum Kubernetes role your work needs.
* Have a concise reason ready, including the Fleet Manager task or incident and the intended
operation.
## 1. Log In to Teleport
Authenticate with your nscale Google account. You normally need to do this once per local
[Teleport](./glossary#teleport) session. If you already have a regular Teleport session, continue to the request flow;
you still need to assume the approved request in [Step 3](#3-assume-the-approved-request-and-log-in-to-kubernetes).
```bash theme={null}
tsh login --proxy=nscale.teleport.sh --auth=google
```
## 2. Create a Temporary Access Request
1. Open [Teleport](https://nscale.teleport.sh) and select **Identity Governance** then
**Access Requests**.
2. Select **New Access Request**.
3. Search for the Fleet Manager cluster, then select the required **production** cluster. Check
its `env: prod` and region labels before continuing; similarly named development and production
resources are listed together.
4. Select **Proceed to Request**.
5. Choose **Temporary** access and select only the roles required for the task:
* `nscale-k8s-viewer` for read-only inspection.
* `nscale-k8s-editor` when the task requires changing application resources.
* `nscale-k8s-admin` only when the task explicitly requires administrator privileges.
The screenshot below intentionally selects only `nscale-k8s-viewer`. The exact permissions of
these roles are platform-managed; if none maps clearly to the task, ask the Fleet Manager team
before requesting broader access.
6. Set the shortest practical duration. In **Request Reason**, state the Fleet Manager issue or
incident, the target cluster, and the operation you will perform. Do not include secrets.
7. Select **Submit Request**.
Wait for the request to be approved. The Teleport notification or request page displays the
request ID and approval status.
If a request is not auto-approved, ask in
[#cnp-re-chat](https://grid-nscaleworkspace.enterprise.slack.com/archives/C08U2N2C5C5). If it
should have been auto-approved, raise a request in
[gcloud-iac](https://github.com/nscaledev/gcloud-iac).
## 3. Assume the Approved Request and Log In to Kubernetes
Replace the placeholders with the approved request ID and the exact cluster name you selected:
```bash theme={null}
# Assume your approved temporary access request.
tsh login --request-id=
# Configure kubectl for the selected cluster.
tsh kube login
```
Confirm that `kubectl` is using the intended cluster before doing any work:
```bash theme={null}
kubectl config current-context
kubectl get namespaces
```
You can now use `kubectl` or `k9s` within the role and duration granted by the request.
## 4. Return to Regular Access When You Finish
Drop the request from your **current local identity** as soon as the task is complete:
```bash theme={null}
tsh request drop
```
This returns the local `tsh` session to regular access. It does **not** cancel or revoke the
approved request: it remains assumable until its expiry. If access must be revoked earlier, contact
the access-request approver or a Teleport administrator. If you need further access later, create a
new temporary request with a new reason. Never use another person's credentials.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.