How to predefine KUBECONFIG localion for tsh kube?

[riuvshyn]

Applies To

tsh kube

Details

I am looking for a way to have similar user experience as it used to be with v17 where I could:

• logged in once - session is available for all terminal sessions
• logged in to another cluster it appends kubeconfig so then I can use kubectl --context
• using kubectl without running tsh proxy or tsh kubectl which is very painful

How can I configure teleport client to always use specified KUBECONFIG?

How will we know this is resolved?

Related Issues

[mg1986jp]

In v18+ the kube login flow changed — tsh kube login doesn't directly write to ~/.kube/config by default anymore. You probably want to add this to your shell profile:

export KUBECONFIG=${KUBECONFIG:-$HOME/.kube/config}:$HOME/.tsh/kubeconfig

Then after tsh login && tsh kube login <cluster>, the kube context should be available to plain kubectl without needing tsh proxy or tsh kubectl.

If you're switching between multiple clusters, tsh kube login <cluster> should still append contexts. You can then use kubectl config use-context or --context as usual.

Another approach is eval $(tsh env) which sets up the environment variables for the current session, but that only affects the current shell.

[riuvshyn]

hey @mg1986jp that is what I was trying to do... but it never worked.
basically once I login tsh login && tsh kube login <cluster> I get this message:

Your Teleport cluster runs behind a layer 7 load balancer or reverse proxy.

To access the cluster, use "tsh kubectl" which is a fully featured "kubectl"
command that works when the Teleport cluster is behind layer 7 load balancer or
reverse proxy. To run the Kubernetes client, use:
  tsh kubectl version

Or, start a local proxy with "tsh proxy kube" and use the kubeconfig
provided by the local proxy with your native Kubernetes clients:
  tsh proxy kube -p 8443

and kubectl is not working at all without proxy or doing tsh kubectl

if I try to use kubectl I always get:

ERROR: Cannot connect Kubernetes clients to Teleport Proxy directly. Please use `tsh proxy kube` or `tsh kubectl` instead.

Unable to connect to the server: getting credentials: exec: executable /usr/local/bin/tsh failed with exit code 1

[webvictim]

You're getting this message for exactly the reason stated - because your Teleport proxy is running behind a layer 7 load balancer or reverse proxy.

In this situation, it isn't possible to connect kubectl directly to Teleport without using tsh proxy kube or tsh kubectl

There's some more information about why this is the case here: https://goteleport.com/docs/reference/architecture/tls-routing/#kubernetes

That said, running tsh proxy kube <cluster> --exec should launch you into a new shell with the correct kubeconfig exported where you can use kubectl directly.