> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubernetes accounts

> Give people kubectl access to Kubernetes clusters.

A Kubernetes account lets people run `kubectl` against a cluster without holding a service account token. They connect through the Infisical CLI, and Infisical records each [session](https://infisical.com/docs/documentation/platform/pam/sessions/overview). Kubernetes accounts don't support browser access.

## Prerequisites

* The Admin [role](https://infisical.com/docs/documentation/platform/pam/concepts/access-control.md) on the [folder](https://infisical.com/docs/documentation/platform/pam/folders/overview.md) you'll add the account to
* A [Gateway](https://infisical.com/docs/documentation/platform/gateways/overview.md) that can reach the cluster's API server
* [`kubectl`](https://kubernetes.io/docs/tasks/tools/) on the machine of each person who connects

## Create an account

**Step 1**

Go to **Privileged Access Management** > **Accounts** and select **Add Account**.

**Step 2**

Select the **Folder** to add the account to and a Kubernetes **Account Template**, such as the default `kubernetes` [template](https://infisical.com/docs/documentation/platform/pam/templates/overview.md), then select **Next**.

**Step 3**

Enter a **Name** for the account and the cluster's connection details:

| Field | Description |
| - | - |
| **Kubernetes API URL** | The URL of the cluster's API server |
| **Reject Unauthorized** | Whether to refuse an API server certificate that the Gateway can't verify |
| **SSL Certificate** | The CA certificate for the API server, if a public CA didn't issue it |
| **Gateway** | The Gateway that connects to the cluster (only shown if the template doesn't set one) |

**Step 4**

Select an **Auth Method** and fill in its fields, as described in [Authentication methods](#authentication-methods).

**Step 5**

Select **Create**.

## Authentication methods

| Method | What you enter | When to use it |
| - | - | - |
| **Service Account Token** | A **Service Account Token** for the cluster | The Gateway runs outside the cluster |
| **Gateway Kubernetes Auth** | The **Namespace** and **Service Account Name** of the service account to act as | The Gateway runs as a pod inside the cluster |

With **Gateway Kubernetes Auth**, the account stores no token. The Gateway authenticates with its own pod's service account and [impersonates](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation) the service account you name. The Gateway's service account needs RBAC permission to `impersonate` that service account.

## Connect

To learn how to launch a session, see [Connect to an account](https://infisical.com/docs/documentation/platform/pam/accounts/connect.md). The CLI command for the account is:

```bash theme={"dark"}
infisical pam access <folder>/<account>
```

The CLI adds a context named `infisical-k8s-pam/<folder>/<account>` to your kubeconfig and makes it the current context, so `kubectl` works without any other setup:

```bash theme={"dark"}
kubectl get pods
```

Press `Ctrl+C` to end the session. The CLI then removes the context from your kubeconfig and switches back to the context you were using before.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.