Kubernetes Clusters and Access
This page combines the old Kubernetes clusters, info, and onboarding guides into one operational reference.
Production Clusters
| Kubed context | Region | Data center | Configuration target |
|---|---|---|---|
us-txwcdip1 |
US | DFW | wxcdi-prod-us-dfw |
us-cawcdip1 |
US | SJC | wxcdi-prod-us-sjc |
The old Kubed documentation uses the context names while deployment configuration may use the environment target names. Confirm both in the current wxcdi-kubed-configs path before rollout or troubleshooting.
The authoritative inventory of all Webex Kubed elemental clusters is maintained in the Kubed cluster documentation.
Access Requirements
Access depends on current MyID group membership and the wxcdi-prod-admin persona defined by the Webex Kubed application group.
| Requirement | Purpose |
|---|---|
wbx3-all |
Base Webex Kubed access |
| WxCDI Kubed production admin group | WxCDI production persona/Keeper authorization |
kubectl-wbx3 |
Creates the temporary cluster login context |
vault-token-helper |
Supports approved Keeper authentication |
| Keeper OIDC access | Issues the temporary identity material used by the login workflow |
Group and persona relationships are defined in the wxcdi-observability application group. Request only the role required for the task.
Onboarding Workflow
- Request or self-join the permitted base group according to MyID policy.
- Request the WxCDI role through the approved access process and provide the operational justification.
- Confirm the role is represented by the expected persona in
wbx3-application-groups. - Install the current supported
kubectl,kubectl-wbx3, Vault CLI, and token helper. - Authenticate to Keeper using OIDC.
- Log in to a non-production or approved production cluster.
- Validate read-only access before attempting a deployment.
- Record the access owner and review/expiry requirements.
See Kubernetes How-To for commands.
Validate the Selected Context
kubectl config get-contexts
kubectl config current-context
kubectl cluster-info
kubectl auth can-i get pods --all-namespaces
Before a production command, verify the context again and specify the namespace explicitly.
Access Troubleshooting
| Symptom | Check |
|---|---|
| HTTP 403 during certificate issuance | Supported kubectl-wbx3 version, MyID groups, persona, Keeper namespace, and current issuer path |
| Login succeeds but context is absent | KUBECONFIG, filesystem permissions, and plugin output |
| Context exists but access is forbidden | Selected role, namespace authorization, and group propagation |
| Keeper OIDC option is absent | Namespace, base access group, browser/SSO session, and role assignment |
| Certificate expired | Reauthenticate; do not copy or extend the generated certificate |
| Wrong cluster selected | Stop and switch context before running any command |
Portals and References
| Resource | Link |
|---|---|
| Webex Kubed documentation | docs.kubed.cisco.com |
| Command and Control UI | Kubed UI |
| ECR synchronization portal | ECR Sync |
| Onboarding repository | wbx3-application-groups |
Never place kubeconfig content, Keeper tokens, generated certificates, or screenshots containing them in documentation or tickets.