Skip to content
Spacelift Flows

Temporary Elevated Access

← Back to gallery

Temporary Elevated Access

Access ManagementFormsKubernetesSlack

This Flow implements just-in-time elevated access for Kubernetes. When a developer opens the request form, the Flow fetches the cluster's namespaces live and offers them as choices, along with an access level (the built-in view, edit, or admin cluster roles), a duration, and a mandatory justification. The request goes to an approver in Slack with Approve and Deny buttons. On approval the Flow creates a RoleBinding for the requester scoped to the chosen namespace, records the grant in the access-grants audit table, and starts a timer for the requested duration. When the timer fires, the RoleBinding is deleted and the audit row is marked revoked, so access always expires on schedule without anyone remembering to clean it up. Grants, denials, revocations, and failures are all reported to Slack, and the audit table keeps the full history with timestamps.

After importing, connect the Flow to your systems: configure the Kubernetes app installation with your API server URL and a token, and create a SLACK_CHANNEL_ID secret with the channel to post approvals and notifications to. The audit table is created automatically on import. The access levels and durations are plain values in the form definition and the Sleep block's duration map, so they are easy to adapt.