Skip to main content
Question

Using Kubernetes cluster tunnel Jump Item effectively

  • August 18, 2025
  • 1 reply
  • 62 views

I’m wondering if anyone has found a way to use a Kubernetes Cluster Tunnel effectively within BeyondTrust PRA, as documented here: https://docs.beyondtrust.com/pra/docs/jump-shortcuts#create-a-kubernetes-cluster-tunnel

Primarily what I’m curious about is how to use the temporarily generated KubeConfig and actually authenticate to a cluster? The KubeConfig that is generated doesn’t appear to do credential injection from PRA, nor can I utilize Azure CLI to get credentials for my AKS cluster injected. 

It seems like it would be a very poor user experience to have to have locally stored cluster credentials which must be added to the generated KubeConfig every time a connection is made. In addition, this is completely divergent from the patterns of PRA and Remote RDP where a user doesn’t have access to privileged credentials at all (due to credential injection). 

I have searched through documentation and opened a support ticket without getting any real answers, so I thought I’d reach out to the community.

1 reply

  • BeyondTrust Employee
  • 55 replies
  • September 26, 2025

Hi ​@jeff.miles

A couple things to note:

  • Kubernetes does not authenticate when the tunnel is initially established but instead each time a user runs a kubectl command.
  • Shared Generic Token Accounts are available for injection into all Kubernetes Cluster Tunnel Jump Shortcuts.

My understanding is that the supported path would be to use a Vaulted “Single Token” for injection into the K8s cluster tunnel jump item. The necessary configuration file is created in a local cache, and then is deleted when the session is closed.

(Ref: Vault accounts | PRA & Use Jump shortcuts | PRA)