connect kube
Command: boundary connect kube
The connect kube
command authorizes a session against a target and invokes a
Kubernetes client for the connection.
The command fills in the local address and port.
You also have access to some templated values that are substituted into the command arguments, and these values are additionally injected as environment variables in the executed command:
{{boundary.ip}}
(BOUNDARY_PROXIED_IP
): The IP address of the listening socket thatboundary connect
has opened.{{boundary.port}}
(BOUNDARY_PROXIED_PORT
): The port of the listening socket thatboundary connect
has opened.{{boundary.addr}}
(BOUNDARY_PROXIED_ADDR
): The host:port format of the address. This is essentially equivalent to{{boundary.ip}}:{{boundary.port}}
.
Examples
The following example authorizes a session to a target with the ID ttcp_1234567890
and runs the get nodes
command using the default kubectl
client:
Usage
This command performs a target authorization or consumes an existing authorization token, and launches a proxied Kube connection.
Connect command options:
-authz-token
(string: "")
- The authorization string returned from the Boundary controller via anauthorize-session
action against a target. This option is only required if you don't set a-target-id
. If you set the value to-
, the command attempts to read in the authorization string from standard input. You can also specify the authorization string using the BOUNDARY_CONNECT_AUTHZ_TOKEN environment variable.-exec
(string: "")
- If set, specifies that the given binary should be executed after connecting to the worker, if set. This value should be a binary on your path or an absolute path. If all command flags are followed by--
(space, two hyphens, space), then any arguments after that are sent directly to the binary. You can also specify a binary using the BOUNDARY_CONNECT_EXEC environment variable.-host-id
(string: "")
- The ID of a specific host to connect to out of the target's host sets. If you do not indicate a specific host, Boundary chooses one at random.-target-id
(string: "")
- The ID of the target to authorize against. You cannot use this option with-authz-token
.-target-name
(string: "")
- The target name, if you authorize the session using scope parameters and target name.-target-scope-id
(string: "")
- The target scope ID, if you authorize the session using scope parameters and target name. This value is mutually exclusive with-scope-name
. You can also specify the target scope ID using the BOUNDARY_CONNECT_TARGET_SCOPE_ID environment variable.-target-scope-name
(string: "")
- The target scope name, if you authorize the session using scope parameters and target name. This value is mutually exclusive with-scope-id
. You can also specify the target scope name using the BOUNDARY_CONNECT_TARGET_SCOPE_NAME environment variable.
Kubernetes options:
-host
(string: "")
- The host value to use. If set, this value overrides the endpoint address from the session information. Boundary passes the specified host name through to the client for use in the TLS SNI value, if supported. You can also specify the host value using the BOUNDARY_CONNECT_KUBE_HOST environment variable.-scheme
(string: "")
- The scheme to use. The default value ishttps
. You can also specify the scheme using the BOUNDARY_CONNECT_KUBE_SCHEME environment variable.-style
(string: "")
- How the CLI attempts to invoke a Kubernetes client. This value also sets a suitable default for-exec
, if you did not specify a value. The default and currently-understood value iskubectl
. You can also specify how the CLI attempts to invoke a Kubernetes client using theBOUNDARY_CONNECT_KUBE_STYLE
environment variable.
CLI options
In addition to the command specific options, there are options common to all CLI commands and subcommands: