Kubernetes

orl kube covers Managed Kubernetes: the clusters, node pools and nodes behind the Kubernetes API, and the credentials kubectl uses to reach a cluster.

CommandsCopy Anchor Link

The cluster, pool and node commands take the same inputs as their API operations, and each API Reference page shows its command. The Managed Kubernetes guide walks through them in order.

orl kube kubeconfigCopy Anchor Link

orl kube kubeconfig --cluster <cluster-id> --output ~/.kube/openrelay
KUBECONFIG=~/.kube/openrelay kubectl get nodes

Writes a kubeconfig for the cluster: its API server, its certificate authority, and a user that runs orl kube token. It holds no credential, so kubectl gets a new cluster token whenever the last one expires and the file keeps working. orl must be on the PATH where kubectl runs.

Which API key the kubeconfig uses is fixed when you write it:

• A key stored with orl auth login (the usual case). The kubeconfig names your organization and reads that organization's stored key, whatever OPENRELAY_API_KEY the shell running kubectl exports and whatever organization you log in to later.
• A key in OPENRELAY_API_KEY. The kubeconfig reads OPENRELAY_API_KEY where kubectl runs, and orl warns you when it writes the file. Store the key with orl auth login to fix it to one key.
• A key given with --api-key is refused: no later kubectl run could read it.

A written kubeconfig's user looks like this. --org and --stored-key pin a stored key; for a key from the environment, --env-key takes their place:

users:
  - name: <user>
    user:
      exec:
        apiVersion: client.authentication.k8s.io/v1
        command: orl
        args:
          - kube
          - token
          - --cluster
          - <cluster-id>
          - --api-url
          - https://api.openrelay.inc
          - --org
          - <org-id>
          - --stored-key
        installHint: 'orl, the OpenRelay CLI, runs this cluster''s credential plugin: https://docs.openrelay.inc/docs/cli'
        interactiveMode: Never
        provideClusterInfo: false

An existing --output file is never merged into, since it may hold other clusters' credentials. Write each cluster's kubeconfig to its own file and list them together in KUBECONFIG (KUBECONFIG=~/.kube/a:~/.kube/b).

orl kube tokenCopy Anchor Link

orl kube token --cluster <cluster-id>

Prints a cluster token as the client.authentication.k8s.io/v1 ExecCredential a kubectl credential plugin prints: a bearer token only that cluster accepts, carrying cluster-admin, which expires after one hour. kubectl runs it for you through the kubeconfig above, so you rarely run it yourself.

The token is kept in the orl config directory, readable only by you, and reused until five minutes before it expires, so kubectl does not mint a token on every request. orl auth logout removes kept tokens.

To hand a token to a client that takes a bearer token:

orl kube token --cluster <cluster-id> | jq -r .status.token

Cluster, pool and node commandsCopy Anchor Link

orl kube cluster create --name training --location-id <locationId>
orl kube cluster list
orl kube node-pool create <cluster-id> --name gpu --count 2 --sku '{"gpuModelId": "<gpuModelId>"}'
orl kube node-pool scale <cluster-id> <pool-id> --count 4
orl kube node list <cluster-id>
orl kube node delete <cluster-id> <node-id>   # drains first; --drain=false skips it
orl kube cluster delete <cluster-id>

--sku and --node-pools take raw JSON, as in the API request. Add --json to print the raw API response, for example to pipe it to jq.