Skip to content
OpenRelay is in early access, and the /v1 API is stable. New capabilities ship in the changelog.
PricingDashboard
GuidesAPI ReferenceCLI
API ReferenceComputeKubernetes

Get a kubeconfig

Returns a kubeconfig for this cluster with a freshly minted one-hour token in the requested role embedded, the kind createKubernetesClusterToken returns. It holds no client certificate, and it stops working when the token expires after one hour. `orl kube kubeconfig` writes one that keeps working: it holds no token and runs `orl kube token` for each kubectl request. A cluster that is deleting or failed answers 409 INVALID_CLUSTER_STATE, and so does a cluster that is creating until its control plane's certificate authority exists. A restricted or pending organization can still get one. A legacy API key needs clusters:write.

Required permission

Requires the kubernetes.credential permission. See Permissions for the roles and API key permissions that include it.

Command line

The orl CLI wraps this endpoint:

Guided workflow: orl kube kubeconfig

orl kube kubeconfig [flags]
GET
/v1/kubernetes/clusters/{id}/kubeconfig

Authorization

apiKey
headerAuthorizationBearer <token>

OpenRelay API key. Send it as Authorization: Bearer or_… (legacy vl_… keys still work).

Path Parameters

id*string

Query Parameters

role?string

Optional role to request. The API may grant cluster-admin when omitted, depending on the organization's authorization configuration.

Value in"cluster-admin""view"

Response Body

The kubeconfig

application/json
  1. response
kubeconfig*string

The kubeconfig document (YAML), ready to save as a file. Its server is https://.k8s.:6443 and it embeds a cluster token, never a client certificate.

role*KubernetesKubeconfigRole
Value in"cluster-admin""view"
expiresAt*string

When the embedded token expires (RFC 3339).

ttlSeconds*integer

The token's lifetime from when it was minted.

Example Request
curl -X GET 'https://api.openrelay.inc/v1/kubernetes/clusters/string/kubeconfig'
Example Response
{  "kubeconfig": "string",  "role": "cluster-admin",  "expiresAt": "string",  "ttlSeconds": 0}

Mint a cluster token POST

Exchanges the caller's API key or session for a bearer token that only this cluster accepts, returned as an ExecCredential. The token expires after one hour. The token carries the requested role; mint another rather than storing it. The response is an ExecCredential so a kubectl exec credential plugin can print it as is. `orl kube token` is such a plugin, and `orl kube kubeconfig` writes a kubeconfig that runs it. A cluster that is deleting or failed answers 409 INVALID_CLUSTER_STATE. A restricted or pending organization can still mint. A legacy API key needs clusters:write.

Overview

Point-in-time VM snapshots and forking new VMs from them: snapshot a VM, list snapshots (optionally by source VM), soft-delete one, or fork a new VM from it.