Kubernetes Access FAQ
This page provides answers to frequently asked questions about Teleport's Kubernetes feature.
Can a single kubernetes_service serve multiple Kubernetes clusters?
Yes, a single kubernetes_service can serve multiple Kubernetes clusters. This
is useful when the Kubernetes clusters' nodes can be downsized to zero, but you
still want to be able to access the Kubernetes API.
Check out the Kubernetes Service Standalone Guide.
Can Teleport be used to restrict access to Kubernetes resources?
Yes. Teleport can be used to restrict access to individual Kubernetes resources.
Check out the Teleport Kubernetes RBAC Guide for more information and examples.
Can Teleport automatically discover my Kubernetes clusters on cloud providers (AWS, GCP, Azure)?
Teleport can discover your Kubernetes clusters on AWS, GCP, and Azure.
Check out the Kubernetes Service Discovery Guide for more documentation and examples.
Does Teleport work with Kubernetes desktop UI applications?
Yes, Teleport generates a kubeconfig file (default ~/.kube/config) when a user
logs in to a Kubernetes cluster. GUI tools such as Lens can
interact with the Kubernetes cluster through Teleport as with any other standard kubeconfig.
How many MFA checks are required to connect to multiple Kubernetes clusters?
One. When per-session MFA is required, a single tsh proxy kube run performs one MFA check
and reuses it for every cluster the local proxy connects to, whether that is three clusters or five hundred.
This requires Teleport 18.12.0 or later
on both tsh and the Teleport cluster.
Headless authentication is the exception.
Under tsh proxy kube --headless, each cluster requires its own MFA check.
Check out Per-session MFA for the full flow and its limitations.