Installation

Prerequisites

• Kubernetes 1.26+
• kubectl configured with cluster access
• Helm 3.x (operator install only)

---

Operator

The operator runs in the cluster and enforces TTLs on escalated bindings.

helm install kube-escalate oci://ghcr.io/layer87-labs/charts/kube-escalate \
  --namespace kube-escalate \
  --create-namespace

Verify the operator is running:

kubectl -n kube-escalate get pods -l app.kubernetes.io/name=kube-escalate

Key values

Value	Default	Description
image.tag	Chart appVersion	Override the operator image tag
replicaCount	1	Set to 2 with leaderElection.enabled=true for HA
leaderElection.enabled	true	Required when replicaCount > 1
metrics.serviceMonitor.enabled	false	Create a Prometheus Operator ServiceMonitor
networkPolicy.enabled	false	Restrict ingress/egress to operator pods
podDisruptionBudget.enabled	false	Enable when replicaCount > 1

Full reference: deploy/helm/values.yaml

Cilium note

If your cluster runs Cilium with kube-proxy-replacement: true (full eBPF kube-proxy replacement), the standard Kubernetes NetworkPolicy cannot express "allow traffic to the API server" in a way that survives Cilium's eBPF DNAT. Use a CiliumNetworkPolicy with toEntities: [kube-apiserver] instead, or leave networkPolicy.enabled: false until that is in place.

---

Plugin (kubectl-escalate)

The plugin runs on your local machine and creates escalated bindings using your cluster credentials.

Linux — amd64

curl -Lo kubectl-escalate.tar.gz \
  https://github.com/layer87-labs/kube-escalate/releases/latest/download/kubectl-escalate_linux_amd64.tar.gz
tar xf kubectl-escalate.tar.gz kubectl-escalate
chmod +x kubectl-escalate
sudo mv kubectl-escalate /usr/local/bin/

macOS — Apple Silicon

curl -Lo kubectl-escalate.tar.gz \
  https://github.com/layer87-labs/kube-escalate/releases/latest/download/kubectl-escalate_darwin_arm64.tar.gz
tar xf kubectl-escalate.tar.gz kubectl-escalate
chmod +x kubectl-escalate
sudo mv kubectl-escalate /usr/local/bin/

macOS — Intel

curl -Lo kubectl-escalate.tar.gz \
  https://github.com/layer87-labs/kube-escalate/releases/latest/download/kubectl-escalate_darwin_amd64.tar.gz
tar xf kubectl-escalate.tar.gz kubectl-escalate
chmod +x kubectl-escalate
sudo mv kubectl-escalate /usr/local/bin/

Windows — amd64

Download kubectl-escalate_windows_amd64.zip from the latest release, extract kubectl-escalate.exe, and place it on your PATH.

Verify

kubectl escalate --version

:::info Krew Krew publication is planned after the first stable release. :::

---

RBAC prerequisites

Plugin user

The user running kubectl escalate needs:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: kube-escalate-user
rules:
  # Resolve identity via SelfSubjectReview (tamper-proof OIDC identity).
  - apiGroups: ["authentication.k8s.io"]
    resources: ["selfsubjectreviews"]
    verbs: ["create"]

  # Create cluster-wide escalations.
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["clusterrolebindings"]
    verbs: ["create"]

  # Create namespace-scoped escalations (only needed for --namespace usage).
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["rolebindings"]
    verbs: ["create"]

For kubectl escalate status --all and kubectl escalate revoke --all, additionally:

  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["clusterrolebindings", "rolebindings"]
    verbs: ["list", "delete"]

Operator

Installed automatically by the Helm chart. See deploy/helm/templates/clusterrole.yaml.