Cluster login

← Documentation · Welcome

The platform runs several clusters. Your app repo has one folder per environment (test/, prod/, …), and each folder is synced to its own cluster - so "which cluster do I log in to?" is really "which folder am I working on?" For isg-* apps:

Every cluster has its own start page with these docs, its login command and its kubeconfig - this page is served by k8s-isg-dev.

How login works

The login script authenticates you via OIDC (your ETH account), installs anything it's missing (kubectl and the kubelogin plugin), and updates your kubeconfig (~/.kube/config) with the context oidc@k8s-isg-dev. The script, the kubeconfig and the cluster's CA certificate are served by the cluster itself and built from its live CA, so they stay valid when the CA is rotated.

If you'd rather not pipe a script, download the cluster's kubeconfig ("context") below - make sure kubelogin is installed and point kubectl at it:

export KUBECONFIG=~/Downloads/k8s-isg-dev.oidc.kubeconfig
kubectl get pods -n <your-namespace>

The ArgoCD UIs use the same ETH login and show you every resource the cluster synced from your repo - your first stop when watching a deployment.

k8s-isg-dev

A development cluster of the platform team, for trying out platform changes - not meant for your apps. It syncs the dev/ folder of a repo.

• Start page: https://home.k8s-isg-dev.inf.ethz.ch

• ArgoCD: https://argocd.k8s-isg-dev.inf.ethz.ch

• Grafana: https://grafana.k8s-isg-dev.inf.ethz.ch

• Context: k8s-isg-dev.oidc.kubeconfig (on Linux/Wayland: the variant that prints the login URL instead of opening a browser)

• Cluster CA: k8s-isg-dev.crt

• Login:

  curl -fsSL https://home.k8s-isg-dev.inf.ethz.ch/login.sh | bash
  

  For a standalone file in ~/.kube/ instead of merging into ~/.kube/config, end it with | bash -s -- -s; -h lists all options.