> ## Documentation Index > Fetch the complete documentation index at: https://docs.together.ai/llms.txt > Use this file to discover all available pages before exploring further. # Sign in to clusters with your Together account > Use your Together account to run kubectl and SSH on a Together-managed OIDC cluster. On a GPU cluster with Together-managed OpenID Connect (OIDC), project collaborators run `kubectl` and SSH with their own Together accounts. Their access follows the [project roles](https://docs.together.ai/docs/roles-permissions.md) you already manage in Together. There's no identity provider to set up and no shared credential to hand out. > [!TIP] > > To use your organization's own identity provider (Google, Okta, Auth0, Entra ID) instead, see [Set up OIDC authentication](https://docs.together.ai/docs/cluster-oidc.md). ## Check whether your cluster uses Together-managed OIDC Open the cluster in the [Together AI console](https://api.together.ai/clusters). A cluster with Together-managed OIDC shows: * An **OIDC Issuer** of the form `https://dex..cloud.together.ai/t-`. * An **OIDC Kubeconfig** row whose **Quick setup** installs `kubelogin`. ## How it works Each cluster gets its own sign-in service at its issuer URL. When you run `kubectl`, the `kubelogin` plugin opens your browser to that service, which sends you to the Together sign-in page. Only collaborators on the cluster's project can sign in. After you sign in, the service issues a signed ID token that carries your email address and your project role, and `kubelogin` caches the token under `$HOME/.kube/cache/oidc-login/`. The cluster's Kubernetes API server uses your email address as your Kubernetes username and your project role as a group. Kubernetes role-based access control (RBAC) then decides what you can do, starting from the [default bindings](#default-access). ## Default access When the cluster first becomes ready, it gets one RBAC binding per project role: | Project role | Kubernetes group | ClusterRole | What it allows | | - | - | - | - | | **admin** | `proj::admin` | `cluster-admin` | Full control of the cluster. | | **editor** | `proj::member` | `view` | Read most resources in every namespace. No access to Secrets, `kubectl exec`, or nodes. | These bindings are named `ums-oidc-admin` and `ums-oidc-member`. Together creates them only once and doesn't overwrite later changes, so a cluster admin can edit them or [grant more access](#grant-more-access) with new bindings. > [!NOTE] > > Editors can run `kubectl get pods --all-namespaces`, but `kubectl get nodes` returns `403 Forbidden`, because the `view` role doesn't include nodes. ## Connect with kubectl **1. Install kubelogin** Install [int128/kubelogin](https://github.com/int128/kubelogin), which provides the `kubectl oidc-login` plugin: > [tab] Homebrew > > ```bash theme={null} > brew install kubelogin > ``` > [tab] Krew > > ```bash theme={null} > kubectl krew install oidc-login > ``` > [tab] Chocolatey > > ```bash theme={null} > choco install kubelogin > ``` **2. Save the OIDC kubeconfig** In the console, open the cluster and select **View** next to **OIDC Kubeconfig**. Copy the kubeconfig and save it to `$HOME/.kube/oidc-config.yaml`: ```bash theme={null} mkdir -p $HOME/.kube pbpaste > $HOME/.kube/oidc-config.yaml # macOS ``` On Linux, replace `pbpaste` with `xclip -selection clipboard -o`, or select **Download** instead of **View** and save the file to the same path. If you don't see the **OIDC Kubeconfig** row, ask a project admin to share theirs. The OIDC kubeconfig contains no credentials, so it's safe to share with anyone in the project. **3. Verify access** Run a `kubectl` command with the OIDC kubeconfig: ```bash theme={null} kubectl --kubeconfig=$HOME/.kube/oidc-config.yaml get pods ``` Your browser opens the Together sign-in page. After you sign in, the command runs as your email address. Later commands reuse the cached token until it expires. ## Grant more access To grant access beyond the defaults, create standard RBAC bindings with the admin kubeconfig, or with an OIDC kubeconfig signed in as a project admin. For example, to let one editor manage workloads in a namespace, bind their email address: ```bash theme={null} kubectl create rolebinding alice-edit \ --clusterrole=edit \ --user="alice@company.com" \ --namespace=team-a ``` To give every editor in the project the same access, bind their project role group instead: ```bash theme={null} kubectl create rolebinding editors-edit \ --clusterrole=edit \ --group="proj::member" \ --namespace=team-a ``` ## Revoke access To revoke a collaborator's access to the cluster: 1. Remove them from the cluster's project in [**Settings > Project > Collaborators**](https://api.together.ai/settings/projects/~current/collaborators). They can no longer sign in to the cluster, but a token they already have keeps their project role's access until it expires, up to 24 hours after sign-in. 2. Delete any RBAC bindings that name their email address. This immediately removes the access those bindings granted. ## SSH with your Together account On clusters that support OIDC SSH, the same Together sign-in gives you SSH access without an SSH key. The Together CLI's `tg clusters ssh` command signs you in through the cluster's issuer and gets a short-lived SSH certificate for your email address from the cluster's certificate authority. After you're removed from the cluster's project, you can't get a new certificate, but one you already have works until it expires. See [Connect over SSH](https://docs.together.ai/docs/gpu-clusters-ssh.md) for the commands. ## Troubleshooting ### `403 Forbidden` You signed in, but your role doesn't allow the request. Editors can't list nodes or read Secrets by default. Run `kubectl auth whoami` with the OIDC kubeconfig to check which username and groups the cluster sees, then ask a cluster admin to [grant more access](#grant-more-access) if you need it. ### Sign-in fails in the browser The Together sign-in page only admits collaborators on the cluster's project. Check that the Together account you signed in with is a collaborator on that project. ### The browser doesn't open Check that `kubelogin` is installed and on your `PATH`: ```bash theme={null} kubectl oidc-login --help ``` ### Access didn't change after a role update Your token carries the project role you had when you signed in, so a role change takes effect at your next sign-in. Clear the cached token so the next command signs in again: ```bash theme={null} kubectl oidc-login clean ``` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.