Skip to content
OpenRelay is in early access, and the /v1 API is stable. New capabilities ship in the changelog.
PricingDashboard
GuidesAPI ReferenceCLI
API ReferenceComputeKubernetes

Mint a cluster token

Exchanges the caller's API key or session for a bearer token that only this cluster accepts, returned as an ExecCredential. The token expires after one hour. The token carries the requested role; mint another rather than storing it. The response is an ExecCredential so a kubectl exec credential plugin can print it as is. `orl kube token` is such a plugin, and `orl kube kubeconfig` writes a kubeconfig that runs it. A cluster that is deleting or failed answers 409 INVALID_CLUSTER_STATE. A restricted or pending organization can still mint. A legacy API key needs clusters:write.

Required permission

Requires the kubernetes.credential permission. See Permissions for the roles and API key permissions that include it.

Command line

The orl CLI wraps this endpoint:

Guided workflow: orl kube token

orl kube token [flags]
POST
/v1/kubernetes/clusters/{id}/token

Authorization

apiKey
headerAuthorizationBearer <token>

OpenRelay API key. Send it as Authorization: Bearer or_… (legacy vl_… keys still work).

Path Parameters

id*string

Query Parameters

role?string

Optional role to request. The API may grant cluster-admin when omitted, depending on the organization's authorization configuration.

Value in"cluster-admin""view"

Response Body

A cluster token

application/json
  1. response

A client.authentication.k8s.io/v1 ExecCredential, the object a kubectl exec credential plugin prints, so a plugin can pass the response through unchanged.

apiVersion*"client.authentication.k8s.io/v1"
Value in"client.authentication.k8s.io/v1"
kind*"ExecCredential"
Value in"ExecCredential"
status*
Example Request
curl -X POST 'https://api.openrelay.inc/v1/kubernetes/clusters/string/token'
Example Response
{  "apiVersion": "client.authentication.k8s.io/v1",  "kind": "ExecCredential",  "status": {    "token": "string",    "expirationTimestamp": "string",    "role": "cluster-admin"  }}

Delete a node DELETE

Removes the node from the cluster and releases its host, draining it first unless drain is false, and drops its pool's count by one so the node is not replaced. Poll getKubernetesNode, which answers 404 once removal completes. The pool's last node is not deleted: that answers 409 LAST_NODE_IN_POOL, and deleting the pool removes it. A cluster that is deleting answers 409 INVALID_CLUSTER_STATE. A legacy API key needs clusters:write.

Get a kubeconfig GET

Returns a kubeconfig for this cluster with a freshly minted one-hour token in the requested role embedded, the kind createKubernetesClusterToken returns. It holds no client certificate, and it stops working when the token expires after one hour. `orl kube kubeconfig` writes one that keeps working: it holds no token and runs `orl kube token` for each kubectl request. A cluster that is deleting or failed answers 409 INVALID_CLUSTER_STATE, and so does a cluster that is creating until its control plane's certificate authority exists. A restricted or pending organization can still get one. A legacy API key needs clusters:write.