--- title: SSH Kubernetes:\ Permissions and Dynamic Workloads description: A tutorial demonstrates how to use Teleport (an SSH server with certificate-based authentication) to implement role-based access control tied to dynamic... canonical: https://daily.dev/posts/ssh-kubernetes-permissions-and-dynamic-workloads-h7idxndcj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SSH Kubernetes:\ Permissions and Dynamic Workloads | daily.dev og:description: A tutorial demonstrates how to use Teleport (an SSH server with certificate-based authentication) to implement role-based access control tied to dynamic... og:url: https://daily.dev/posts/ssh-kubernetes-permissions-and-dynamic-workloads-h7idxndcj og:image: https://api.daily.dev/og/posts/H7IDxNdcj.png og:image:alt: SSH Kubernetes:\ Permissions and Dynamic Workloads og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SSH Kubernetes:\ Permissions and Dynamic Workloads **[Teleport](https://daily.dev/sources/teleport)** · 6 min read · 0 upvotes · 0 comments ## Summary A tutorial demonstrates how to use Teleport (an SSH server with certificate-based authentication) to implement role-based access control tied to dynamic Kubernetes workloads rather than static hostnames. It shows how to expose Kubernetes pod labels as SSH-addressable hostnames using a custom label command, and how to define Teleport roles (like 'dba') that restrict SSH access to nodes carrying specific labels, such as restricting database access to only qualified team members. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I restrict SSH access to Kubernetes nodes based on pod labels instead of hostnames? Teleport supports label commands that periodically run a script on each node to fetch a Kubernetes label value (like 'role=db-master') and expose it as an SSH-visible node label. You then define a Teleport role, such as 'dba', with a node_labels restriction matching that label, so only users with that role can SSH into matching nodes, regardless of which physical server currently holds the workload. _Teams wiring access control to dynamic infrastructure can track Kubernetes and SSH security patterns on daily.dev._ ### How do I SSH into a server by Kubernetes label instead of IP address using Teleport? Use the tsh client with the label as the target, for example 'tsh ssh root@role=db-master', after configuring a label command in teleport.yaml that reports Kubernetes labels like 'role' for each node. This lets administrators reach whichever machine currently runs a given workload, such as the PostgreSQL master, without tracking changing IP addresses. _Engineers automating dynamic infrastructure access can follow Kubernetes and SSH tooling updates on daily.dev._ ## Similar posts on daily.dev - [Stop managing SSH keys on every server and switch to Teleport](https://daily.dev/posts/stop-managing-ssh-keys-on-every-server-and-switch-to-teleport-zoja48gov) · All Things Open · 0 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#ssh](https://daily.dev/tags/ssh) [View this post on daily.dev](https://daily.dev/posts/ssh-kubernetes-permissions-and-dynamic-workloads-h7idxndcj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SSH Kubernetes:\\ Permissions and Dynamic Workloads","url":"https://daily.dev/posts/ssh-kubernetes-permissions-and-dynamic-workloads-h7idxndcj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ssh-kubernetes-permissions-and-dynamic-workloads-h7idxndcj"},"datePublished":"2026-08-23T12:22:08.311Z","dateModified":"2026-08-23T12:42:36.570Z","description":"A tutorial demonstrates how to use Teleport (an SSH server with certificate-based authentication) to implement role-based access control tied to dynamic...","image":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","thumbnailUrl":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ssh-kubernetes-permissions-and-dynamic-workloads-h7idxndcj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,ssh","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"SSH Kubernetes:\\ Permissions and Dynamic Workloads"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ssh-kubernetes-permissions-and-dynamic-workloads-h7idxndcj#faq","mainEntity":[{"@type":"Question","name":"How can I restrict SSH access to Kubernetes nodes based on pod labels instead of hostnames?","acceptedAnswer":{"@type":"Answer","text":"Teleport supports label commands that periodically run a script on each node to fetch a Kubernetes label value (like 'role=db-master') and expose it as an SSH-visible node label. You then define a Teleport role, such as 'dba', with a node_labels restriction matching that label, so only users with that role can SSH into matching nodes, regardless of which physical server currently holds the workload. Teams wiring access control to dynamic infrastructure can track Kubernetes and SSH security patterns on daily.dev."}},{"@type":"Question","name":"How do I SSH into a server by Kubernetes label instead of IP address using Teleport?","acceptedAnswer":{"@type":"Answer","text":"Use the tsh client with the label as the target, for example 'tsh ssh root@role=db-master', after configuring a label command in teleport.yaml that reports Kubernetes labels like 'role' for each node. This lets administrators reach whichever machine currently runs a given workload, such as the PostgreSQL master, without tracking changing IP addresses. Engineers automating dynamic infrastructure access can follow Kubernetes and SSH tooling updates on daily.dev."}}]} ```