> ## Documentation Index
> Fetch the complete documentation index at: https://hoopdev-docs-changelog-1-43-2.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Kubernetes Interactive Access

> Open interactive shell sessions inside Kubernetes containers with full TTY support and session recording.

export const ConnectionTemplate = ({config}) => {
  const defaultConfig = {
    name: "Connection",
    description: "Connection description",
    features: {
      tlsTerminationProxy: {
        native: false,
        oneOff: false
      },
      audit: {
        native: false,
        oneOff: false
      },
      dataMaskingGoogleDLP: {
        native: false,
        oneOff: false
      },
      dataMaskingMSPresidio: {
        native: false,
        oneOff: false
      },
      guardrails: {
        native: false,
        oneOff: false
      },
      credentialsOffload: {
        native: false,
        oneOff: false
      },
      interactiveAccess: {
        native: false,
        oneOff: false
      }
    }
  };
  const finalConfig = Object.assign({}, defaultConfig, config);
  const renderIcon = enabled => {
    return enabled ? <Icon icon="check" /> : <Icon icon="xmark" />;
  };
  return <div>
      <h2>Before you start</h2>
      <p>To get the most out of this guide, you will need to:</p>
      <ul>
        <li>Either <a href="https://use.hoop.dev">create an account in our managed instance</a> or <a href="/getting-started/installation/overview">deploy your own hoop.dev instance</a></li>
        <li>You must be your account administrator to perform the following commands</li>
      </ul>

      {finalConfig.requirements && <>
          <h2>Requirements</h2>
          <p>{finalConfig.requirements.description}</p>
          {finalConfig.requirements.items && <ul>
            {finalConfig.requirements.items.map(item => <li>{item}</li>)}
          </ul>}
        </>}

      <h2>Features</h2>
      <p>The table below outlines the features available for this type of connection.</p>
      
      <ul>
        <li><strong>Native</strong> - This refers to when a database client connects through a specific protocol, such as an IDE or client libraries through <code>hoop connect &lt;connection-name&gt;</code>.</li>
        <li><strong>One Off</strong> - This term refers to accessing this connection from hoop web panel.</li>
      </ul>

      <table>
        <thead>
          <tr>
            <th>Feature</th>
            <th>Native</th>
            <th>One Off</th>
            <th>Description</th>
          </tr>
        </thead>
        <tbody>
          <tr>
            <td>TLS Termination Proxy</td>
            <td>{renderIcon(finalConfig.features?.tlsTerminationProxy?.native)}</td>
            <td>{renderIcon(finalConfig.features?.tlsTerminationProxy?.oneOff)}</td>
            <td>The local proxy terminates the connection with TLS, enabling the connection with the remote server to be TLS encrypted.</td>
          </tr>
          <tr>
            <td>Audit</td>
            <td>{renderIcon(finalConfig.features?.audit?.native)}</td>
            <td>{renderIcon(finalConfig.features?.audit?.oneOff)}</td>
            <td>The gateway stores and audits the queries being issued by the client.</td>
          </tr>
          <tr>
            <td>Data Masking (Google DLP)</td>
            <td>{renderIcon(finalConfig.features?.dataMaskingGoogleDLP?.native)}</td>
            <td>{renderIcon(finalConfig.features?.dataMaskingGoogleDLP?.oneOff)}</td>
            <td>A policy can be enabled to mask sensitive fields dynamically when performing queries in the database.</td>
          </tr>
          <tr>
            <td>Data Masking (MS Presidio)</td>
            <td>{renderIcon(finalConfig.features?.dataMaskingMSPresidio?.native)}</td>
            <td>{renderIcon(finalConfig.features?.dataMaskingMSPresidio?.oneOff)}</td>
            <td>A policy can be enabled to mask sensitive fields dynamically when performing queries in the database.</td>
          </tr>
          <tr>
            <td>Guardrails</td>
            <td>{renderIcon(finalConfig.features?.guardrails?.native)}</td>
            <td>{renderIcon(finalConfig.features?.guardrails?.oneOff)}</td>
            <td>An intelligent layer of protection with smart access controls and monitoring mechanisms.</td>
          </tr>
          <tr>
            <td>Credentials Offload</td>
            <td>{renderIcon(finalConfig.features?.credentialsOffload?.native)}</td>
            <td>{renderIcon(finalConfig.features?.credentialsOffload?.oneOff)}</td>
            <td>The user authenticates via SSO instead of using database credentials.</td>
          </tr>
          <tr>
            <td>Interactive Access</td>
            <td>{renderIcon(finalConfig.features?.interactiveAccess?.native)}</td>
            <td>{renderIcon(finalConfig.features?.interactiveAccess?.oneOff)}</td>
            <td>Interactive access is available when using an IDE or connecting via a terminal to perform analysis exploration.</td>
          </tr>
        </tbody>
      </table>

      {finalConfig.resourceConfiguration.credentials && <>
      <h2>Configuration</h2>
      <table>
        <thead>
          <tr>
            <th>Name</th>
            <th>Type</th>
            <th>Required</th>
            <th>Description</th>
          </tr>
        </thead>
        <tbody>
          {Object.entries(finalConfig.resourceConfiguration.credentials).map(([key, credential]) => {
    if (typeof credential === 'string' || credential.hidden) return null;
    return <tr key={key}>
                <td>{credential.name}</td>
                <td>{credential.type}</td>
                <td>{credential.required ? 'yes' : 'no'}</td>
                <td>
                  {credential.description?.split(/(\[[^\]]+\]\([^)]+\))/).map((part, index) => {
      const linkMatch = part.match(/\[([^\]]+)\]\(([^)]+)\)/);
      if (linkMatch) {
        return <a key={index} href={linkMatch[2]} target="_blank" rel="noopener noreferrer">{linkMatch[1]}</a>;
      }
      return part;
    })}
                </td>
              </tr>;
  }).filter(Boolean)}
        </tbody>
      </table>
      </>}
    </div>;
};

<ConnectionTemplate
  config={{
"id": "kubernetes-interactive",
"name": "Kubernetes Interactive Access",
"description": "Open interactive shell sessions inside Kubernetes containers with full TTY support and session recording.",
"category": "cloud-services",
"icon-name": "kubernetes",
"tags": [
"containers",
"interactive",
"development"
],
"features": {
"tlsTerminationProxy": {
  "native": false,
  "oneOff": true
},
"audit": {
  "native": false,
  "oneOff": true
},
"dataMaskingGoogleDLP": {
  "native": false,
  "oneOff": true
},
"dataMaskingMSPresidio": {
  "native": false,
  "oneOff": true
},
"guardrails": {
  "native": false,
  "oneOff": true
},
"credentialsOffload": {
  "native": false,
  "oneOff": true
},
"interactiveAccess": {
  "native": true,
  "oneOff": true
}
},
"overview": {
"description": "Access your Kubernetes containers interactively through Hoop.dev with full TTY support, comprehensive session recording, and intelligent access controls. Open shell sessions for debugging, development, and administrative tasks with complete audit trails."
},
"setupGuide": {
"accessMethods": {
  "webapp": false,
  "cli": true,
  "runbooks": false
}
},
"resourceConfiguration": {
"type": "custom",
"subtype": "kubernetes-interactive",
"command": [
  "kubectl",
  "exec",
  "--stdin",
  "--tty",
  "$KUBERNETES_RESOURCE",
  "--"
],
"credentials": [
  {
    "name": "KUBECONFIG",
    "type": "filesystem",
    "required": true,
    "description": "A [Kubeconfig File](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) with permission to access the cluster",
    "placeholder": "file content of ~/.kube/config"
  },
  {
    "name": "KUBERNETES_RESOURCE",
    "type": "env-var",
    "required": true,
    "description": "The Kubernetes resource to target for interactive access (e.g., deployment/myapp, pod/mypod, statefulset/myapp)",
    "placeholder": "deployment/myapp"
  }
]
},
"documentationConfig": {
"path": "quickstart/cloud-services/kubernetes/interactive-access"
}
}}
/>

### Connection Setup

Interactive access can be achieved by using the `kubectl exec` command with the `--stdin` and `--tty` flags.

```bash theme={null}
  hoop admin create conn myapp -a <agent> \
	-e KUBECONFIG=file://$HOME/.kube/config \
	-e KUBERNETES_RESOURCE=deployment/myapp \
	-- kubectl exec --stdin --tty $KUBERNETES_RESOURCE --
```

<Tip>
  To narrow down the scope to a specific command, you can use the name of the command you want to run.
  E.g.: `-- bash` or `-- rails console`.

  In this example users could use any runtime command inside the specified Kubernetes resource.
</Tip>

This will allow users to open an interactive shell inside the specified Kubernetes resource. This is useful for debugging or running commands interactively inside a container.

### Command Line Usage Examples

```bash theme={null}
  # Open an interactive session with the deployment myapp using 'bash'
  hoop connect myapp -- bash
  # Open an interactive session with the deployment myapp using 'rails console'
  hoop connect myapp -- rails console
```

<Info>
  Note that `kubectl exec` is used with `-tty` and `--stdin` arguments.
  These flags are required when using `hoop connect`
</Info>