Privileged Access Management (PAM) for Kubernetes

Kubernetes is being adopted throughout enterprise IT as the de facto container orchestration service. Along with this adoption, companies are struggling with the “day-two” operational tasks such as managing usage, training users and securing clusters. Securing clusters has become a primary concern as unmanaged access to Kubernetes can lead to critical vulnerabilities throughout an organization’s private infrastructure.

Teleport can be used as a proxy to your Kubernetes clusters in order to secure your infrastructure and improve visibility into access and behavior. It also gives you a single control plane to manage both SSH and Kubernetes access, reducing your operational overhead.

Who can Benefit from Teleport's Kubernetes PAM?

Using Teleport instead of individually-managed authorization and authentication methods means companies can now have a single control plane to manage role-based access control (RBAC) for Kubernetes clusters and clusters of SSH servers for their organization but also for third-party teams. This is useful for:

  • supervised_user_circleCompany-wide compliance teams overseeing multiple infrastructure and engineering groups who use both Kubernetes and SSH.
  • view_comfyManage service providers (MSPs) that manage Kubernetes and generic server clusters for clients.
  • settings_system_daydreamRemote support teams from software vendors who wish to manage remote on-site Kubernetes clusters.
  • cloud_circleInternet-of-Things (IoT) edge cloud management from a centralized office.

PAM for Kubernetes Highlights

Teleport was built from the ground up to support highly elastic, cloud-native infrastructure being accessed by multiple teams. Teleport integration with Kubernetes extends Teleport benefits to teams who have adopted Kubernetes-based operations:

Unified cluster level permissions. Teleport seamlessly integrates with Kubernetes role based access controls ("RBAC") so you can connect permissions set in your identity manager with permissions for your Kubernetes clusters and these permissions are enforced for SSH access as well. This makes it impossible to "bypass" Kubernetes RBAC via SSH or vice versa.

Audit log and session recording. Teleport's strong audit and compliance features apply to Kubernetes clusters as well. Interactive sessions or remote commands launched via kubectl are recorded and can be replayed for compliance, knowledge sharing or root-cause analyses.

Federate trust across Kubernetes clusters. Teleport's trusted clusters allows you to configure trust across Kubernetes clusters in order to manage permissions across teams and organizations.

A bridge from legacy workflows. Using a single tool like Teleport to manage both SSH access to your servers and to Kubernetes API endpoints allows you to seamlessly support both modern and legacy workflows as your organization transitions to cloud-native operations.

Which Teleport offering is right for you?

Teleport is available through our commercial Enterprise offering or the Community open source software.

Teleport Enterprise

Teleport Enterprise is built around the open-source core, with premium support and additional, enterprise-grade features. It is for organizations that need to secure critical production infrastructure and meet compliance and audit requirements.

Teleport Enterprise includes:

Role Based Access Controls (RBAC) for both SSH and Kubernetes clusters.

Integration with all Enterprise Single Sign-On (SSO) providers.

Multi-cluster dashboard with cross-cloud visibility into access and behavior.

Enterprise-grade support with SLAs and dedicated Slack channel.

2-years of long term support and maintenance (2-year LTS).

Prioritized hotfixes and patches for all supported releases under LTS.

Teleport feature roadmap collaboration with product management.

Demo Teleport Enterprise

Teleport Community

Teleport Community provides modern SSH best practices out of the box for managing elastic infrastructure. Teleport Community is open-source software that anyone can download and install for free.

Teleport Community includes:

Local user database and SSO/RBAC integration with Github.

Monitoring of Github issues and community driven roadmap.

Binaries published for Linux, MacOS and Windows (client only).

Best efforts support via email. Hotfixes and patches for most recent release.

Download Teleport Community