Namespace Access

Most of the time your team works with workloads through SVIEW and never needs
direct cluster access. When you do need to run kubectl yourself — debugging,
tailing logs, a one-off query — you get temporary namespace access brokered by
Teleport.

Before you start

Install the Teleport CLI (tsh). Use the version that matches the Teleport
cluster you connect to: open https://teleport.manage.cto2b.eu in a browser
and take the version shown on the login or downloads page, then download that
same version from goteleport.com/download.

Confirm the installed version with:

tsh version

A tsh that is older or newer than the cluster is the most common cause of odd
login failures.

Step 1 — request access

Raise an access request in SVIEW for the Kubernetes namespace resource
type, choosing your namespace and the role you need (for example read-only or
exec). The Access Requests article covers the request and approval flow in
full.

Wait until the request shows Approved before continuing.

Step 2 — log in to Teleport

tsh login --user <your-email> --proxy https://teleport.manage.cto2b.eu

Step 3 — connect to the cluster

tsh kube login <cluster-name>

The cluster name matches the environment shown in SVIEW. After login, kubectl
is configured to point at your namespace.

Verify it worked

kubectl get pods -n <your-namespace>

A list of pods means you are connected and scoped correctly.

Useful commands

Task	Command
List pods	`kubectl get pods -n <namespace>`
Tail live logs	`kubectl logs -f <pod-name> -n <namespace>`
Logs from a crashed pod	`kubectl logs <pod-name> -n <namespace> --previous`
Pod details and events	`kubectl describe pod <pod-name> -n <namespace>`
Recent events	`kubectl get events -n <namespace> --sort-by='.lastTimestamp'`
Shell into a running pod	`kubectl exec -it <pod-name> -n <namespace> -- /bin/sh`

exec requires the exec role. If kubectl exec is denied, request the
higher-privilege role in SVIEW.

Access expiry

Your Teleport session is time-limited. When it expires, raise a new access
request — the session is not extended automatically.

Common issues

Issue	What to check
`tsh kube login` finds no clusters	Is the access request approved? Check Access requests in SVIEW
`kubectl` commands suddenly fail	Run `tsh kube login` again — the session may have expired
`kubectl exec` is denied	Your role may not include exec. Request it in SVIEW
Expected pods are missing	Confirm the namespace with `-n <namespace>`
`tsh login` fails oddly	Check `tsh version` against the version the Teleport cluster reports

Still having issues? Raise a request and include the full error message.

Access Requests
Connect to a Database