# Kubernetes clusters

Some teams run workloads on managed Kubernetes clusters that Dina brokers for them. The CLI lets you list the clusters you've been granted access to and wire up `kubectl` to talk to them — without VPNs, without downloading a long-lived kubeconfig token, and without managing certificates yourself.

You reach a cluster's API through Dina. When `kubectl` makes a request, Dina checks who you are, confirms you still have access, and forwards the request to the real cluster on your behalf. Access is evaluated on every request, so if your grant is revoked, the next command stops working.

<div class="callout"><strong>Prerequisites:</strong> You need to be <a href="/docs/authentication">signed in</a> (<code>dina auth login</code>) and have <code>kubectl</code> installed. Access to a cluster is granted by a platform administrator — if <code>dina clusters list</code> is empty, you haven't been added to any yet.</div>

## List the clusters you can reach

```sh
dina clusters list
```

You'll see a table of every cluster you've been granted access to, with its name, region, status, and Kubernetes version. For a machine-readable version:

```sh
dina clusters list --output json
```

## Connect kubectl to a cluster

```sh
dina clusters connect my-cluster
```

This adds an entry to your kubeconfig (context, cluster, and user, all named `dina-my-cluster`) and switches your current `kubectl` context to it. From then on, `kubectl` just works:

```sh
kubectl get pods
kubectl get namespaces
```

Behind the scenes, the kubeconfig entry points `kubectl` at Dina's public endpoint and uses the CLI as an authentication helper — each request is authorised with your existing Dina session. There's no separate token to copy around and nothing to rotate. When your Dina session expires, run `dina auth login` again and `kubectl` picks up the refreshed session automatically.

### Keep your current context

By default, connecting switches your active `kubectl` context to the new cluster. If you'd rather add the cluster without changing which context is current, pass `--set-current=false`:

```sh
dina clusters connect my-cluster --set-current=false
```

You can then switch to it whenever you want:

```sh
kubectl config use-context dina-my-cluster
```

## What you can do depends on your role

An administrator grants you one of three roles on each cluster:

- **viewer** — read-only access.
- **editor** — read and modify most resources.
- **admin** — full access within the cluster.

Your role is enforced by the cluster itself. If a command comes back with a "forbidden" error, you're authenticated correctly but your role doesn't allow that action — ask an administrator if you need more.

## Streaming and long-running commands

The connection supports the interactive and streaming parts of `kubectl`, so these all work as usual:

```sh
kubectl logs -f deploy/my-app
kubectl exec -it pod/my-app-xyz -- sh
kubectl port-forward svc/my-app 8080:80
kubectl get pods --watch
```

## Common problems

**`dina clusters list` is empty.** You haven't been granted access to any cluster. Ask a platform administrator to add you.

**`kubectl` says "Unauthorized".** Your Dina session may have expired. Run `dina auth login` and try again.

**`kubectl` says "forbidden".** You're signed in, but your role on that cluster doesn't permit the action. Ask an administrator for a higher role.