Kubernetes clusters

Some teams run workloads on managed Kubernetes clusters that Dina brokers for them. The CLI lets you list the clusters you’ve been granted access to and wire up kubectl to talk to them — without VPNs, without downloading a long-lived kubeconfig token, and without managing certificates yourself.

You reach a cluster’s API through Dina. When kubectl makes a request, Dina checks who you are, confirms you still have access, and forwards the request to the real cluster on your behalf. Access is evaluated on every request, so if your grant is revoked, the next command stops working.

List the clusters you can reach

dina clusters list

You’ll see a table of every cluster you’ve been granted access to, with its name, region, status, and Kubernetes version. For a machine-readable version:

dina clusters list --output json

Connect kubectl to a cluster

dina clusters connect my-cluster

This adds an entry to your kubeconfig (context, cluster, and user, all named dina-my-cluster) and switches your current kubectl context to it. From then on, kubectl just works:

kubectl get pods
kubectl get namespaces

Behind the scenes, the kubeconfig entry points kubectl at Dina’s public endpoint and uses the CLI as an authentication helper — each request is authorised with your existing Dina session. There’s no separate token to copy around and nothing to rotate. When your Dina session expires, run dina auth login again and kubectl picks up the refreshed session automatically.

Keep your current context

By default, connecting switches your active kubectl context to the new cluster. If you’d rather add the cluster without changing which context is current, pass --set-current=false:

dina clusters connect my-cluster --set-current=false

You can then switch to it whenever you want:

kubectl config use-context dina-my-cluster

What you can do depends on your role

An administrator grants you one of three roles on each cluster:

• viewer — read-only access.
• editor — read and modify most resources.
• admin — full access within the cluster.

Your role is enforced by the cluster itself. If a command comes back with a “forbidden” error, you’re authenticated correctly but your role doesn’t allow that action — ask an administrator if you need more.

Streaming and long-running commands

The connection supports the interactive and streaming parts of kubectl, so these all work as usual:

kubectl logs -f deploy/my-app
kubectl exec -it pod/my-app-xyz -- sh
kubectl port-forward svc/my-app 8080:80
kubectl get pods --watch

Common problems

dina clusters list is empty. You haven’t been granted access to any cluster. Ask a platform administrator to add you.

kubectl says “Unauthorized”. Your Dina session may have expired. Run dina auth login and try again.

kubectl says “forbidden”. You’re signed in, but your role on that cluster doesn’t permit the action. Ask an administrator for a higher role.