Getting Started

Overview

This guide walks you through configuring the Britive Access Broker to manage just-in-time RBAC access to Kubernetes clusters — creating a ClusterRoleBinding or RoleBinding at checkout and deleting it at checkin.

What you’ll accomplish:

Deploy and configure the Britive Access Broker with kubeconfig access to your cluster
Configure checkout and checkin routines from the access-broker-examples repository
Register the Kubernetes cluster as a Resource Manager resource in Britive
Create a Resource Manager access profile
Check out cluster access and verify end-to-end

Prerequisites

Before you begin, make sure you have:

A Britive tenant with administrator access
A running Britive Access Broker with network access to the Kubernetes API server
A kubeconfig with cluster-admin (or equivalent) permissions for the broker service account
kubectl available on the broker host

Never hardcode credentials. Use environment variables, your secret manager, or the Britive Secrets Store.

How It Works

The Access Broker uses kubectl to create and delete Kubernetes RBAC bindings. At checkout, Britive creates a ClusterRoleBinding (or RoleBinding for namespace-scoped access) for the user. At checkin (or on expiry), the binding is deleted — no standing cluster permissions remain.

User → Britive Console → Access Broker → kubectl → ClusterRoleBinding/RoleBinding (create/delete)

Onboarding the Application

Configure the broker for Kubernetes RBAC management. This is a one-time setup performed by an administrator.

Reference scripts are available in the britive/access-broker-examples repository under Kubernetes/permissions/. For EKS and GKE deployment of the broker itself, see the britive/onboarding repository under Access Broker/.

Using the Britive Console

Deploy the Access Broker

Follow the Britive Access Broker deployment guide to install and register a broker. For EKS, use the deployment templates in britive/onboarding/Access Broker/eks-deployment/.

Configure broker kubeconfig

Create a Kubernetes service account and ClusterRoleBinding for the broker, then copy the resulting kubeconfig to the broker.

# broker-sa.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: britive-broker
  namespace: britive
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: britive-broker-admin
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- kind: ServiceAccount
  name: britive-broker
  namespace: britive

Configure the broker scripts

git clone https://github.com/britive/access-broker-examples.git
# Copy Kubernetes/permissions/ scripts to your broker's scripts directory

Register the cluster in Resource Manager

Navigate to Resource Manager → Resources → Add Resource. Enter the cluster API server URL and kubeconfig details.

Using Shell

Key environment variables used by the broker scripts:

KUBECONFIG=/home/britivebroker/.kube/config
K8S_CLUSTER_NAME=prod-cluster
K8S_NAMESPACE=default   # empty for cluster-scoped bindings
K8S_CLUSTER_ROLE=view   # e.g., view, edit, cluster-admin
BRITIVE_USER_EMAIL=user@example.com

Refer to the britive/access-broker-examples Kubernetes/ directory for the full script set, including sample RBAC configs in k8s-quick-start/.

Using Terraform

resource "britive_resource_manager_resource_type" "kubernetes" {
  name        = "KubernetesCluster"
  description = "Kubernetes cluster"

  parameters {
    param_name   = "cluster_name"
    param_type   = "string"
    is_mandatory = true
  }
  parameters {
    param_name   = "api_server"
    param_type   = "string"
    is_mandatory = true
  }
}

resource "britive_resource_manager_resource" "k8s_prod" {
  name          = "k8s-prod"
  resource_type = britive_resource_manager_resource_type.kubernetes.name

  parameter_values = {
    cluster_name = "prod-cluster"
    api_server   = "https://api.prod-cluster.example.com"
  }

  resource_labels = {
    environment = "Production"
  }
}

Create Your First Access Profile

Using the Britive Console

Open Resource Manager

Navigate to Resource Manager → Profiles → Add Profile.

Configure the profile

Field	Value
Name	A descriptive name (e.g., `K8s-ViewOnly`)
Expiration	Set a max session duration (e.g., `1h`)

Associate resources

Under Associations, select the Kubernetes cluster resource.

Add a permission

Under Permissions, select the checkout/checkin routine for the target cluster role.

Add a policy

Under Policies, assign members and configure conditions.

Save and activate

Click Save.

Using Terraform

resource "britive_resource_manager_profile" "k8s_view" {
  name                = "K8s-ViewOnly"
  expiration_duration = 3600000

  associations {
    label_key = "environment"
    values    = ["Production"]
  }
}

resource "britive_resource_manager_profile_permission" "k8s_perm" {
  profile_id = britive_resource_manager_profile.k8s_view.id
  name       = "Kubernetes-View-Access"
  version    = "latest"

  variables {
    name              = "K8S_CLUSTER_ROLE"
    value             = "view"
    is_system_defined = false
  }
}

Verify

Check out the profile

Navigate to My Access → find your profile → click Check Out. Britive returns a kubeconfig or connection instructions.

Confirm RBAC binding

kubectl get clusterrolebindings | grep britive
kubectl auth can-i list pods --as=<your-username>

Check in

Return to My Access → click Check In. The ClusterRoleBinding should be deleted:

kubectl auth can-i list pods --as=<your-username>
# Expected: no

Troubleshoot

Symptom	Likely Cause	Fix
Checkout fails	Broker cannot reach the API server	Check network connectivity and API server firewall rules
`Forbidden` when creating binding	Broker service account lacks `cluster-admin`	Verify the ClusterRoleBinding for the broker service account
Binding not deleted after checkin	`kubectl delete` error in checkin routine	Check broker logs; manually delete the binding with `kubectl delete clusterrolebinding`

Next Steps

Britive documentation

Last updated on July 8, 2026