Skip to main content

honey kube login

honey kube login​

Enroll a device certificate and write a kubeconfig context for the honey k8s proxy

Synopsis​

Obtains a short-lived client certificate signed by honey's device CA and writes a kubeconfig cluster/user/context that points kubectl at the honey Kubernetes access proxy for the given cluster.

Two identity sources are supported:

  • With --enroll-code: redeems a one-time device enrollment code minted by an operator via honey device enroll-code (the code fixes the certificate identity).
  • Without --enroll-code: runs a browser SSO (OIDC) sign-in; honey maps the verified identity to a Kubernetes user and groups via policy, and returns the proxy's serving CA so --proxy-ca is not required.

By default the SSO path writes a kubeconfig authInfo that invokes "honey kube login" as a kubectl exec credential plugin, so kubectl transparently refreshes the certificate via SSO as it nears expiry (honey must stay on PATH). Pass --static to instead embed the certificate and key directly, as the --enroll-code path always does (it has no SSO session to refresh from).

Example: honey kube login prod --enroll-code abc123 --proxy proxy.example:6443
--proxy-ca proxy-ca.pem honey kube login prod --proxy proxy.example:6443 kubectl --context honey-prod get pods

honey kube login <cluster> [flags]

Options​

      --admin-url string           honey web base URL used to redeem the enrollment code (default $HONEY_WEB_URL, else http://localhost:8765) (default "http://localhost:8765")
      --context string             kubectl context name to create (default: honey-<cluster>)
      --enroll-code string         One-time enrollment code from honey device enroll-code (fixes the certificate identity); when empty, a browser SSO sign-in is used instead
  -h, --help                       help for login
      --insecure-skip-tls-verify   Skip verification of the proxy's serving certificate instead of pinning --proxy-ca (insecure)
      --kubeconfig string          kubeconfig file to update (default: $KUBECONFIG first entry, else ~/.kube/config)
      --no-browser                 print the sign-in URL instead of opening a browser
      --proxy string               honey k8s-proxy address kubectl connects to, host:port (required)
      --proxy-ca string            PEM file with the CA that signed the proxy's serving certificate
      --static                     embed the certificate directly instead of the auto-refreshing exec plugin

Options inherited from parent commands​

      --cache-dir string     Override cache directory (default: XDG_CACHE_HOME/honey)
      --cache-ttl duration   Cache time-to-live (host discovery) (default 10m0s)
      --config string        Path to honey YAML (optional; also HONEY_CONFIG or default paths)
      --debug-log string     Path to write debug logs (disables debug logging if empty)
      --no-cache             Bypass read/write cache (host discovery)
      --record-dir string    Session recording directory for search (TUI), web, and cue-exec; overrides defaults.record_dir; default <directory of config.yaml>/records
      --refresh              Ignore cached entries and refresh (host discovery)

SEE ALSO​

  • honey kube - Manage kubectl access through the honey Kubernetes access proxy