Deploying in Kubernetes

Airlock provides unified secure access to Kubernetes clusters. This guide covers deploying Auth Service and Proxy Service in Kubernetes using Helm.

If Auth Service and Proxy Service are already running on another platform, use the existing Airlock cluster and connect Kubernetes using the Kubernetes agent guide.

Prerequisites

• A registered domain name (for TLS via Let’s Encrypt and Proxy Service verification by clients).
• A Kubernetes cluster with load balancer and persistent volume support.
• A Persistent Volume for storing Auth Service state:

kubectl get pv

If no volumes exist, enable dynamic volume provisioning or create a PV manually. Check for a default StorageClass:

kubectl get storageclasses

• The airsh client installed on your workstation.
• Kubernetes >= 1.28, Helm >= 3.14:

helm version
kubectl version

Step 1 of 2. Install Airlock

Add the Helm Repository

helm repo add airlock https://charts.airlock.deckhouse.ru
helm repo update

Create the Namespace

kubectl create namespace airlock-cluster
kubectl label namespace airlock-cluster 'pod-security.kubernetes.io/enforce=baseline'
kubectl config set-context --current --namespace=airlock-cluster

Helm Values File

Set clusterName (for example, airlock.example.com) and acmeEmail for Let’s Encrypt:

cat << EOF > airlock-cluster-values.yaml
clusterName: airlock.example.com
proxyListenerMode: multiplex
acme: true
acmeEmail: admin@example.com
EOF

Install the airlock-cluster Chart

helm install airlock-cluster airlock/airlock-cluster \
  --create-namespace \
  --values airlock-cluster-values.yaml

Wait for the Auth Service and Proxy Service pods to start:

kubectl get pods

Expected output:

NAME                                      READY   STATUS    RESTARTS   AGE
airlock-cluster-auth-000000000-00000     1/1     Running   0          114s
airlock-cluster-proxy-0000000000-00000   1/1     Running   0          114s

Configure DNS

Get the external load balancer address:

kubectl get services/airlock-cluster

Create DNS records for airlock.example.com and *.airlock.example.com:

Verify cluster availability:

curl https://airlock.example.com/webapi/ping

Step 2 of 2. Create a Local User

Local users provide a reliable fallback when SSO is unavailable. Create a member role with access to the Kubernetes system:masters group:

kind: role
version: v7
metadata:
  name: member
spec:
  allow:
    kubernetes_labels:
      '*': '*'
    kubernetes_groups:
    - system:masters

kubectl exec -i deployment/airlock-cluster-auth -- airctl create -f - < member.yaml

Create a user and get the invitation link:

kubectl exec -ti deployment/airlock-cluster-auth -- airctl users add myuser --roles=member,access,editor

Follow the link from the command output and activate the account.

Log in via airsh:

airsh login --proxy=airlock.example.com:443 --user=myuser
airsh kube ls

For safe kubeconfig management, use a separate file:

KUBECONFIG=$HOME/airlock-kubeconfig.yaml airsh kube login airlock.example.com
KUBECONFIG=$HOME/airlock-kubeconfig.yaml kubectl get -n airlock-cluster pods

Troubleshooting

If connectivity is not working, check pod status:

kubectl get pods -n airlock-cluster

The Auth Service pod may remain in Pending state if a PersistentVolumeClaim cannot be provisioned. Use kubectl describe pod and kubectl logs for diagnostics:

kubectl get events --sort-by='.metadata.creationTimestamp' -A

Next Steps

• Configure single sign-on (SSO) for production deployments.
• Connect additional Kubernetes clusters via the Kubernetes agent.
• Restrict Kubernetes access rights using Airlock RBAC instead of system:masters.