Quick start

Install one binary, open the terminal UI, and issue a standalone kubeconfig from an existing Kubernetes context. kticket does not change your administrator kubeconfig or add anything to the cluster control plane.

Requirements

Linux, macOS, or Windows on amd64 or arm64.
A working administrator kubeconfig and a reachable Kubernetes API server.
Permissions to read namespaces and RBAC resources, create a ServiceAccount and binding, and create serviceaccounts/token.

Install

Download the file for your platform and architecture from the download page. Extract the Linux tar.gz or macOS zip archive to get kticket; Windows uses a direct exe download.

# Linux amd64
tar -xzf kticket_linux_amd64.tar.gz
mv kticket /usr/local/bin/kticket
kticket --help

Each download includes its own <filename>.sha256. Verify it before extracting or installing.

Activate before issuing credentials

Issuing kubeconfigs and adding grants require a valid license. Get this machine’s ID, then follow license purchase and activation to install the file received by email. You can explore the TUI, view accounts, and revoke access without activation.

kticket license machine-id
kticket license install /path/to/kticket-license.ktlicense
kticket license status

Open the terminal UI

Run kticket without a subcommand, then choose a cluster and action. Press F2 to switch among six languages; your draft is kept.

kticket

Select accounts, grants, duration, and output directory. Confirm before issuing credentials.

Use the CLI in a script

To issue credentials from a script, use the CLI. This command grants alice read access in the existing app-prod namespace and requests an eight-hour credential. The view ClusterRole must already exist.

kticket issue --context my-cluster --username alice \
  --access namespace --role view --role-namespace app-prod \
  --duration 8h --output ./alice.kubeconfig

Test the generated file without changing your current kubeconfig:

kubectl --kubeconfig ./alice.kubeconfig \
  get pods --namespace app-prod

Inspect and revoke

kticket list --context my-cluster --credentials
kticket access list --context my-cluster --username alice
kticket revoke --context my-cluster --username alice

Note: CLI write commands run immediately and do not ask for confirmation. Use the TUI when you want to review changes before applying them.