Kubernetes — portal and automation features

Beyond downloading kubeconfig, Loopback exposes read and operational Kubernetes features through the project/workspace scope. These use server-side kubeconfig material and enforce RBAC before touching the cluster.

Version information

Current version — resolved Kubernetes version record for the workspace.
Available upgrades — versions that are active in the catalog and allowed by the version’s upgrade graph from your current semver.
Trigger upgrade — asynchronous job; returns accepted while coordinators upgrade control plane and workers.

Details: Lifecycle & upgrades.

Kubeconfig and OIDC

Admin kubeconfig — full super-admin file (sensitive permission).
OIDC kubeconfig — uses kubectl oidc-login with workspace-scoped client id and client secret; integrates with platform-configured OIDC issuer.

Details: Access & identity.

Kubernetes API proxy (read-oriented summaries)

The following capabilities query the cluster API with workspace credentials and return summaries (useful for dashboards without giving every user a kubeconfig):

Cluster summary — high-level cluster health / capacity snapshot (implementation aggregates API lists).
Nodes — node list and status summary.
Ingress objects — ingress resources across namespaces (filtered/summarized).
LoadBalancer-type services — Kubernetes services of type LoadBalancer (distinct from Loopback LoadBalancer product objects).
Helm releases — detected Helm releases (where discoverable via API conventions).
Volumes — persistent volume claims / volume summary helpers.

Operational actions

Cordon / uncordon node — marks node unschedulable or restores scheduling (by host id linkage).
Drain node — evicts workloads subject to Kubernetes drain semantics.

These mutate cluster state — require appropriate workspace.kubernetes family permissions (often update/execute class).

Events and deployments listings

Separate routes expose:

Kubernetes events stream or list (for troubleshooting).
Kubernetes deployments visible to the portal — helps operators compare what Loopback thinks vs kubectl.

Secrets workflow

If enabled for your role, kubernetes.secrets permission unlocks portal interactions with Kubernetes Secret objects (create from form, rotate, etc.). Treat this as highly sensitive — equivalent to reading application credentials.

Integration with catalog apps

Kubernetes applications install into namespaces like loopback-<app>. Portal Kubernetes views show aggregated state but do not replace kubectl describe for deep debugging.

See Kubernetes applications.