Namespace Access
Get temporary kubectl access to your namespace through Teleport for debugging, logs and one-off commands, and fix common login problems.
Most of the time your team works with workloads through SVIEW and never needs
direct cluster access. When you do need to run kubectl yourself — debugging,
tailing logs, a one-off query — you get temporary namespace access brokered by
Teleport.
Before you start
Install the Teleport CLI (tsh). Use the version that matches the Teleport
cluster you connect to: open https://teleport.manage.cto2b.eu in a browser
and take the version shown on the login or downloads page, then download that
same version from goteleport.com/download.
Confirm the installed version with:
tsh versionA tsh that is older or newer than the cluster is the most common cause of odd
login failures.
Step 1 — request access
Raise an access request in SVIEW for the Kubernetes namespace resource
type, choosing your namespace and the role you need (for example read-only or
exec). The Access Requests article covers the request and approval flow in
full.
Wait until the request shows Approved before continuing.
Step 2 — log in to Teleport
tsh login --user <your-email> --proxy https://teleport.manage.cto2b.euStep 3 — connect to the cluster
tsh kube login <cluster-name>The cluster name matches the environment shown in SVIEW. After login, kubectl
is configured to point at your namespace.
Verify it worked
kubectl get pods -n <your-namespace>A list of pods means you are connected and scoped correctly.
Useful commands
| Task | Command |
|---|---|
| List pods | kubectl get pods -n <namespace> |
| Tail live logs | kubectl logs -f <pod-name> -n <namespace> |
| Logs from a crashed pod | kubectl logs <pod-name> -n <namespace> --previous |
| Pod details and events | kubectl describe pod <pod-name> -n <namespace> |
| Recent events | kubectl get events -n <namespace> --sort-by='.lastTimestamp' |
| Shell into a running pod | kubectl exec -it <pod-name> -n <namespace> -- /bin/sh |
exec requires the exec role. If kubectl exec is denied, request the
higher-privilege role in SVIEW.
Access expiry
Your Teleport session is time-limited. When it expires, raise a new access
request — the session is not extended automatically.
Common issues
| Issue | What to check |
|---|---|
tsh kube login finds no clusters | Is the access request approved? Check Access requests in SVIEW |
kubectl commands suddenly fail | Run tsh kube login again — the session may have expired |
kubectl exec is denied | Your role may not include exec. Request it in SVIEW |
| Expected pods are missing | Confirm the namespace with -n <namespace> |
tsh login fails oddly | Check tsh version against the version the Teleport cluster reports |
Still having issues? Raise a request and include the full error message.
Related articles
- Access Requests
- Find Your Application Logs — SVIEW and Grafana alternatives to
kubectl logs - Connect to a Database
Updated about 1 month ago