> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nuphos.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# On-prem Kubernetes

> Connect a private cluster through an outbound relay before granting credentials.

An Administrator opens **Connectors → Connect → Kubernetes**. The wizard proves
an outbound tunnel before accepting a cluster credential; do not open the API
server publicly just to connect it.

## Enrol in order

1. **Name it.** Use lowercase letters, digits and dashes. The name becomes the
   kubectl context, so choose something unambiguous.
2. **Install the agent.** Review and run the exact manifest/command generated by
   the wizard in the intended cluster. It contains enrollment-specific values;
   do not reuse another cluster's instructions. Wait for the relay to connect.
3. **Grant access.** Create the ServiceAccount and RBAC appropriate to the intended
   work using the wizard's instructions, then enter its kubeconfig in the secure
   field. It needs the server address, CA and token. Review the access results
   returned by the cluster itself.

Closing partway through enrollment can leave a resumable connection; return to
that entry instead of installing duplicate agents.

## Verify

Read a known namespace with the new context. Check both relay status and actual
RBAC permissions. An online relay does not itself grant cluster-admin. The
cluster appears in the shared [Kubernetes browser](https://docs.nuphos.ai/infrastructure/clusters.md).

## Troubleshoot and retire

Check outbound connectivity and relay pod health before replacing credentials.
If access is denied, inspect the ServiceAccount's RoleBindings/ClusterRoleBindings.
Remove the Nuphos connection, relay workload and no-longer-needed RBAC deliberately
when decommissioning. Removing a UI connection alone is not cluster cleanup.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.