Kubernetes Exec

Kubernetes exec opens a recorded browser shell into a pod. Configure the common bsh settings first. For local kubectl access, use the separate HTTP proxy walkthrough.

Configure the Kubernetes permission

bsh creates a ServiceAccount, binds it to an existing Role, and requests a bounded token. The administrative token needs permission to perform those operations in the target namespace. Set these permission variables:

BSH_KUBE_API_SERVER=https://api.k8s.example.com:6443
BSH_KUBE_TOKEN_FILE=/run/secrets/kubernetes-admin-token
BSH_KUBE_CA_CERT_PATH=/run/certs/kubernetes-ca.pem
BSH_TARGET_CA_CERT=file:///run/certs/kubernetes-ca.pem
BSH_KUBE_NAMESPACE=payments
BSH_KUBE_ROLE=bridge-exec
BSH_KUBE_POD=checkout-api-7d9f8b6c4-x2klm
BSH_KUBE_CONTAINER=app
BSH_KUBE_COMMAND=/bin/bash
BSH_KUBE_TTY=true
BSH_BLOCKED_COMMANDS=kubectl,curl

Create the bridge-exec Role separately with the pod and exec permissions that this permission needs. Kubernetes RBAC controls access. Command filtering is a best-effort session control.

BSH_KUBE_POD identifies the pod. bsh sends that value as the checkout’s target_host. It sends the API address in kube_api_server. The two CA settings verify the administrative connection and Bridge’s connection separately.

Configure the scripts

#!/bin/sh
exec bsh checkout k8s --method serviceaccount-token --mode bridge

#!/bin/sh
exec bsh checkin k8s --method serviceaccount-token --mode bridge

Checkin ends the Bridge checkout and removes the role binding. It deletes the ServiceAccount by default. The requested token lifetime comes from BSH_SESSION_DURATION, between 10m and 24h. If Kubernetes issues a shorter lifetime, bsh shortens the Bridge checkout to match.

Verify

Request the permission through Britive and open Connect for the resulting checkout. Confirm that the terminal opens in the specified pod and container. Check in the permission and confirm that access ends.

See the Kubernetes exec reference and bsh Kubernetes method settings.