Use kubectl

Work with your Plexivo Kubernetes workload using the kubectl you already have. Each kubeconfig is issued fresh, expires on its own, and works only while you can manage the organisation.

Get a kubeconfig#

1. Open the workload’s Connect tab. In Connect with kubectl, choose Reveal. Plexivo issues a new kubeconfig and shows when it expires.
2. Copy it. Choose Copy and save it as ~/.kube/config, or as its own file that you pass with --kubeconfig.

# Save the copied kubeconfig, then:
export KUBECONFIG=~/plexivo-web.yaml
kubectl get pods

• Short-lived. A kubeconfig works for 12 hours by default. Reveal again for a new one.
• Bound to you. Every request checks that you may still manage the organisation. Remove a member, or lower their role, and their kubeconfigs stop working.
• Recorded. Each reveal is in the audit log, with when it expires. Plexivo stores no copy, and the browser keeps none.
• Your namespace only. It works in the workload’s own namespace. Workloads created before 27 October 2026 share one namespace per organisation: there the kubeconfig reads every workload’s objects and changes only its own.

Rotate#

Choose Rotate on the Connect tab to revoke every kubeconfig issued for the workload so far, the one on your screen included. kubectl stops working until you reveal a new one. Use it when someone leaves the team or a laptop goes missing.

# The same with the API
curl -s $API/kubernetes/$WORKLOAD/kubeconfig -H "Authorization: Bearer $PLEXIVO_TOKEN"
curl -s -X POST $API/kubernetes/$WORKLOAD/kubeconfig/rotate -H "Authorization: Bearer $PLEXIVO_TOKEN"

Deploy#

kubectl apply -f web.yaml
kubectl get deployments,pods,services,ingresses
kubectl describe pod web-7d4b9c-xk2lp
kubectl logs web-7d4b9c-xk2lp
kubectl scale deployment web --replicas=3
kubectl delete -f web.yaml

Your manifests follow a few rules; see Manifests and limits for an example that passes them. Objects you create with kubectl are part of the workload and billed with it.

What kubectl does not do here#

Plexivo answers every kubectl request itself and lets through only reads and writes in your namespace. So these are not available:

• kubectl exec, attach, port-forward and proxy.
• Watching: --watch or -w, kubectl logs -f, and kubectl rollout status. Run the command again instead, or follow the workload’s Overview, which refreshes every 10 seconds.
• Server-side apply (--server-side). Plain kubectl apply works.
• Requests larger than 3 MiB.

Expose a service over HTTPS#

Public HTTPS comes from the Ingress objects in the workload’s manifests: the ones you deploy from the console, or send with the API. Give each an exact host, pathType: Prefix and a ClusterIP Service behind it. Plexivo serves it over HTTPS and manages the certificate. The host must be one of:

• a free plexivo.app name ending in your organisation’s six characters, as the console shows when you create a public workload: web-3f9a1c.plexivo.app;
• your own domain, added and verified under Networking → Custom domains with Plexivo Kubernetes (Ingress host) as the target. See Custom domains.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: web
spec:
  rules:
    - host: web-3f9a1c.plexivo.app
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: web
                port:
                  number: 80

To add or change an Ingress after the workload exists, send the full manifest list, the Ingress included, with the API:

curl -s -X PUT $API/kubernetes/$WORKLOAD \
  -H "Authorization: Bearer $PLEXIVO_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"manifests": [ … every object, as JSON … ]}'

Next steps#