Kubernetes
Thinfinity® Cloud Manager connects to a Kubernetes cluster using the cluster’s API URL and a bearer Token for authentication. Kubernetes credentials are used exclusively by K8S VDI/DaaS Models, where Cloud Manager brokers user sessions to pods scheduled on the cluster — including Remote Browser Isolation (RBI) sessions, where each user connection spawns a containerized browser pod. See Remote Browser Isolation (RBI).
This article documents the Cloud Manager credential form for Kubernetes, the in-cluster configuration case, validation behavior, and common errors.
reaches the Kubernetes API over an outbound connection from the Thinfinity® Workspace host; it requires no inbound port. Allow outbound HTTPS egress from that host to the cluster’s API endpoint (typically port 6443). See Prerequisites for the full network requirements.
Kubernetes is available as a VDI/DaaS Model type only; it has no Managed VM workflow. See Choosing a Compute Path.
Prerequisites
Before adding Kubernetes credentials in Cloud Manager, the following must be in place on the cluster side:
- A Kubernetes cluster whose API server is reachable from the Thinfinity Workspace server.
- A service account (or user) whose bearer token Cloud Manager will use to authenticate.
- An RBAC role bound to that service account granting permission to manage pods, services, and leases (
coordination.k8s.io) in the namespace where pods will run. Leases are used by the idle auto-delete mechanism. - The namespace in which Cloud Manager will create pods and services. This is defined in the model’s Kubernetes configuration, not in the credential — see Kubernetes Models.
The built-in browser container images (Chrome noVNC, Chrome RDC) are pulled from a private registry. If your cluster requires explicit pull credentials, ensure the service account’s namespace contains the appropriate imagePullSecrets, or add them to the pod manifest in the model’s K8S Configuration. See Remote Browser Isolation (RBI).
For how to create service accounts, issue tokens, and define Roles and RoleBindings, refer to the Kubernetes documentation.
Authentication Methods
| Method | When to Use |
|---|---|
| Bearer Token | The standard method. Provide the cluster API URL and a service account token. Works from any Thinfinity Workspace server that can reach the cluster API. |
| In-cluster | Used automatically when the Thinfinity Workspace server itself runs as a pod inside the target cluster. No credential fields are required — see In-Cluster Configuration. |
Add the Credentials in Cloud Manager
- In Cloud Manager, go to Credentials and click + New.
- Select K8S as the provider.
- Fill in the fields below and click Save.
For the full Add / Edit / Delete procedure, see Managing Credentials.
Credential Fields
| Field | Description |
|---|---|
| Kubernetes API URL | Required. The base URL of the cluster’s API server, including scheme and port — for example, https://10.0.0.10:6443. |
| Token | The service account bearer token used to authenticate API requests. This is the working authentication method. |
| Certificate file | Upload a client certificate (.crt). |
| Private key file | Upload the client private key (.key) that pairs with the certificate above. |
| Allow Unverified SSL | Present on the form for consistency with the other providers. For Kubernetes, Cloud Manager establishes the connection without validating the API server’s TLS certificate, so clusters presenting a self-signed or internal-CA certificate connect without extra configuration. |
Provide the Token to authenticate. The Certificate file and Private key file fields are present in the form, but in Thinfinity Workspace the connection is established using the bearer Token.
Because the API server’s certificate is not validated, reach the cluster endpoint over a network path you control — the same VPC, VPN, or management network the Prerequisites already require — rather than across the public internet.
In-Cluster Configuration
When the Thinfinity Workspace server runs as a pod inside the target Kubernetes cluster, Cloud Manager automatically uses the pod’s mounted service account — the cluster-internal API endpoint and the service account token are read from the standard in-cluster paths. In this scenario you do not need to provide the Kubernetes API URL or Token manually; the service account assigned to the Workspace pod must still hold the RBAC permissions listed under Prerequisites.
Verification
When you save Kubernetes credentials, Cloud Manager validates that the Kubernetes API URL is present and that an authentication method has been provided. As a precaution, verify that the cluster API is reachable from the Thinfinity Workspace server before deploying a K8S model.
If validation succeeds, the credential status shows as Ok. If it fails, review the error and refer to Common Errors below.
Common Errors
| Error | Likely Cause | Resolution |
|---|---|---|
401 - Unauthorized |
The bearer token is missing, expired, or invalid. | Reissue the service account token and update the credential. |
403 - Forbidden |
The service account lacks RBAC permissions on pods, services, or leases in the target namespace. | Bind a Role granting the required permissions to the service account. See Prerequisites. |
| Connection timeout | The Thinfinity Workspace server cannot reach the cluster API endpoint. | Check firewall, proxy, and the API URL. See Prerequisites. |
| TLS connection error | The Thinfinity Workspace server cannot establish a TLS connection to the API server. | Verify the API URL scheme and port, the network path, and that the API server is reachable. |
Security Recommendations
- Use a dedicated service account scoped to a single namespace with least-privilege RBAC (pods, services, and leases only). Avoid binding
cluster-adminor using personal tokens. - Keep the cluster’s API endpoint on a private, controlled network path reachable from the Thinfinity Workspace server — a VPC, VPN, or management network — and do not expose it to the public internet.
- Rotate service account tokens periodically and update the credential when you do.
- Scope the RBAC Role to the specific namespace used by your K8S models rather than granting cluster-wide permissions.
Each RBI session creates a dedicated pod with its own browser, VNC server, and audio stack. On clusters hosting many concurrent RBI sessions, consider setting ResourceQuotas and LimitRanges on the namespace to keep pod sprawl from exhausting cluster resources. Monitor pod counts and resource consumption through the model’s Pods tab or your cluster’s observability stack.