Skip to main content
An Administrator opens Connectors → Connect → Kubernetes. The wizard proves an outbound tunnel before accepting a cluster credential; do not open the API server publicly just to connect it.

​
Enrol in order

  1. Name it. Use lowercase letters, digits and dashes. The name becomes the kubectl context, so choose something unambiguous.
  2. Install the agent. Review and run the exact manifest/command generated by the wizard in the intended cluster. It contains enrollment-specific values; do not reuse another cluster’s instructions. Wait for the relay to connect.
  3. Grant access. Create the ServiceAccount and RBAC appropriate to the intended work using the wizard’s instructions, then enter its kubeconfig in the secure field. It needs the server address, CA and token. Review the access results returned by the cluster itself.
Closing partway through enrollment can leave a resumable connection; return to that entry instead of installing duplicate agents.

​
Verify

Read a known namespace with the new context. Check both relay status and actual RBAC permissions. An online relay does not itself grant cluster-admin. The cluster appears in the shared Kubernetes browser.

​
Troubleshoot and retire

Check outbound connectivity and relay pod health before replacing credentials. If access is denied, inspect the ServiceAccount’s RoleBindings/ClusterRoleBindings. Remove the Nuphos connection, relay workload and no-longer-needed RBAC deliberately when decommissioning. Removing a UI connection alone is not cluster cleanup.