# Break Glass

## What Will You Do

In this part of the self-paced exercise, you will learn to enable kubectl access temporarily for a cluster to implement a break glass process.

---

## Step 1: Disabling Kubectl Access

The default for many organizations would be to disable kubectl access. To do this:

- Navigate to the Clusters page, click on the gear icon and select Kubectl Settings

- Disable both **Kubectl CLI Access (Terminal)** and **Browser Kubectl Access**

- Any kubectl access attempt is now prevented

## Step 2: Enabling kubectl access temporarily

There may be a requirement to enable kubectl access for a user temporarily (to debug an issue for instance). To enable Browser based access, follow the instructions outlined below:

- Navigate to the specific cluster where the issue is being seen. Click on the gear icon and select Kubectl Settings
- Enable Kubectl Browser access, Click Save

- The Namespace Admin previously configured in [Part 1](https://docs.rafay.co/learn/quickstart/ztka/part1/) of the exercise would now be able to initiate a kubectl session from within the browser and run commands/inspect logs as required

- Kubectl access can be disabled either for the cluster or org wide as required after the root cause determination exercise is complete
- The JIT (Just in time) service account created for the Namespace Admin is automatically removed from the target cluster once the configured lifetime expires