Skip to content

DevOps Student Cluster — Onboarding

This page explains how to connect to the DevOps student cluster using your UGent Microsoft account. Each team can access its own production and staging namespaces; this lab uses staging only.

Install the connection tools

Install mise by following the Getting Started guide, and activate it in your shell. Install the pinned Kubernetes client tools from the infra repository:

cd infra
mise install

This installs the pinned versions of kubectl, kubelogin, and Helm from mise.toml. If you do not have the infra repository locally, install kubectl and kubelogin using mise and pin the versions specified by the course infrastructure repository. Lab 4 requires Helm 4.2.3; see the Helm installation guide if you need to install it separately.

Configure your kubeconfig

From the root of a checkout of the course infrastructure repository, copy the base kubeconfig template to ~/.kube/config:

mkdir -p ~/.kube
cp docs/kubeconfig-template.yaml ~/.kube/config

If you already have a kubeconfig, merge the template instead of overwriting your existing configuration. Run this from the infrastructure repository root:

KUBECONFIG=~/.kube/config:docs/kubeconfig-template.yaml \
  kubectl config view --flatten > /tmp/merged-kubeconfig
mv /tmp/merged-kubeconfig ~/.kube/config

Sign in with UGent SSO

Run a Kubernetes command to start the login flow:

kubectl get namespaces

A browser should open at the course Keycloak login page. Sign in with your UGent Microsoft account. kubelogin caches the token locally until it expires.

If the browser does not open, configure the browser command:

kubelogin setup --browser-command "$(which xdg-open)"

On macOS, use open instead:

kubelogin setup --browser-command open

If browser login still does not work, use the device-code flow. Update the devops-oidc kubeconfig user:

kubectl config set-credentials devops-oidc \
  --exec-api-version=client.authentication.k8s.io/v1beta1 \
  --exec-command=kubectl \
  --exec-arg=oidc-login \
  --exec-arg=get-token \
  --exec-arg=--oidc-issuer-url=https://devops-proxy.atlantis.ugent.be/auth/realms/devops \
  --exec-arg=--oidc-client-id=k8s-oidc \
  --exec-arg=--grant-type=device-code

Run kubectl get namespaces, then open the URL printed in the terminal, enter the displayed code, and complete login. To return to browser login later, remove the --grant-type=device-code argument from the kubeconfig user configuration.

Set up team contexts

Replace N with your team number. Your team has access to:

  • group-N-staging for testing and this lab.
  • group-N for production, which is out of scope for Lab 4.

Create a context that defaults to your staging namespace:

kubectl config set-context group-N-staging \
  --cluster=devops-course \
  --user=devops-oidc \
  --namespace=group-N-staging

kubectl config use-context group-N-staging

Check the active context and namespace before making changes:

kubectl config current-context
kubectl config view --minify
kubectl get pods

Use the explicit -n group-N-staging flag when you want a command to be unambiguous. Do not apply Lab 4 resources to the production namespace. Kubernetes RBAC limits your account to your team's namespaces; attempts to access other teams' namespaces are denied.

Use the shared GitLab Kubernetes agent in CI

CI jobs do not need your personal kubeconfig or SSO token. The shared Kubernetes agent is hosted in the private devops/infra project and grants access to projects under Devops/2026. Your CI jobs are limited to your team's production and staging namespaces.

In a CI job, select the shared agent context and explicitly target your staging namespace:

deploy-staging:
  image: bitnami/kubectl:latest
  rules:
    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
  script:
    - kubectl config use-context devops/infra:k8s-agent
    - kubectl apply -f k8s/ -n "group-${GROUP_N}-staging"
    - kubectl rollout status deployment/logic-service -n "group-${GROUP_N}-staging"

Set GROUP_N as a CI/CD variable, or derive the team number from your GitLab project namespace. The infra repository's deployment template is a starting point; change its default so Lab 4 deploys to staging, not production.

The agent forwards the CI job's GitLab group identity to Kubernetes, where namespace RoleBindings restrict it to your team's namespaces. Never print kubeconfig contents, tokens, or secret values in CI logs.