[Yandex Cloud documentation](../../index.md) > [Yandex Managed Service for Kubernetes](../index.md) > [Step-by-step guides](index.md) > Connecting to a node via OS Login

# Connecting to a node via OS Login

[OS Login](../../organization/concepts/os-login.md) is used instead of SSH keys to access Yandex Cloud virtual machines via SSH. With OS Login, you can connect to Managed Service for Kubernetes nodes.

Individual nodes in node groups are Yandex Compute Cloud virtual machines with automatically generated names. To configure nodes, follow the steps below or [other node group management guides](index.md#node-group).

{% note alert %}

Do not change node VM settings, including names, network interfaces, and SSH keys, using the Compute Cloud interfaces or SSH connections to the VM.

This can disrupt the operation of individual nodes, node groups, and the whole Managed Service for Kubernetes cluster.

{% endnote %}

[Configure your cluster node](#configure-node) and then connect to it using one of the two methods:

* [Using the CLI](#connect-via-cli).
* [Over SSH](#connect-via-ssh).

## Getting started {#before-begin}

1. If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

   The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

1. [Enable access via OS Login](../../organization/operations/os-login-access.md) at the organization level.
1. [Enable access to nodes from the internet](node-group/node-group-update.md#node-internet-access) for the node group containing the node you need to connect to.

1. Make sure the account you are using to connect to the node [has the required roles](../../iam/operations/roles/grant.md):

    * `compute.osLogin` [role](../../compute/security/index.md#compute-oslogin) to access the node without sudo permissions, or `compute.osAdminLogin`, for access with sudo permissions.
    * `resource-manager.auditor` [role](../../resource-manager/security/index.md#resource-manager-auditor) or higher for the folder containing the node.

## Configure the node {#configure-node}

Set up your cluster node for connection:

1. Make sure to enable [external access](node-group/node-group-update.md#node-internet-access) for the node.

1. Enable node access via OS Login by changing the method of connecting to nodes.

    {% note info %}
    
    After you change the connection method, the node group status will temporarily change to `Reconciling`: all the group nodes will be recreated for the changes to take effect.
    
    {% endnote %}

    {% list tabs group=instructions %}

    - Management console {#console}

        1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) containing the Managed Service for Kubernetes cluster whose node you need access to.
        1. Navigate to **Managed Service for&nbsp;Kubernetes**.
        1. Click the name of the Managed Service for Kubernetes cluster.
        1. Navigate to the **Node group** tab.
        1. Select the node group you need.
        1. Click **Edit** in the top-right corner.
        1. Select **Access by OS Login**.

            {% note warning %}
            
            If access via OS Login is enabled, access using SSH keys will not be possible.
            
            {% endnote %}

        1. Click **Save**.

    - CLI {#cli}

      If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

      The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

      To enable OS Login for all nodes in a node group:

      1. View the description of the CLI command for adding and updating the Managed Service for Kubernetes node group metadata:

          ```bash
          yc managed-kubernetes node-group add-metadata --help
          ```

      1. Run this command:

          ```bash
          yc managed-kubernetes node-group add-metadata \
            --name <node_group_name> \
            --metadata enable-oslogin=true
          ```

          You can get the node group name with the [list of node groups in the folder](node-group/node-group-list.md#list).

          {% note warning %}
          
          If access via OS Login is enabled, access using SSH keys will not be possible.
          
          {% endnote %}

    - Terraform {#tf}

      1. Open the current Terraform configuration file describing the Managed Service for Kubernetes node group.

          For more on how to create such a file, see [Creating a node group](node-group/node-group-create.md).

      1. Add the `instance_template.metadata` property to the node group description, or change it if it already exists.

          In this property, specify the `enable-oslogin` metadata key with the `true` value:

          ```hcl
          resource "yandex_kubernetes_node_group" "<node_group_name>" {
            cluster_id = yandex_kubernetes_cluster.<cluster_name>.id
            ...
            instance_template {
              metadata = {
                "enable-oslogin" = "true"
                ...
              }
              ...
            }
            ...
          }
          ```

          {% note warning %}
          
          If access via OS Login is enabled, access using SSH keys will not be possible.
          
          {% endnote %}

      1. Make sure the configuration files are correct.

          1. In the command line, navigate to the directory that contains the current Terraform configuration files defining the infrastructure.
          1. Run this command:
          
             ```bash
             terraform validate
             ```
          
             Terraform will show any errors found in your configuration files.

      1. Confirm resource changes.

          1. Run this command to view the planned changes:
          
             ```bash
             terraform plan
             ```
          
             If you described the configuration correctly, the terminal will display a list of the resources to update and their parameters. This is a verification step that does not apply changes to your resources.
          
          1. If everything looks correct, apply the changes:
             1. Run this command:
          
                ```bash
                terraform apply
                ```
          
             1. Confirm updating the resources.
             1. Wait for the operation to complete.

          {% note warning "Timeouts" %}
          
          The Terraform provider sets time limits for operations with Managed Service for Kubernetes cluster node groups:
          
          * Creating and editing: 60 minutes.
          * Deleting: 20 minutes.
          
          Operations in excess of this time will be interrupted.
          
          {% cut "How do I modify these limits?" %}
          
          Add the `timeouts` section to the cluster node group description, e.g.:
          
          ```hcl
          resource "yandex_kubernetes_node_group" "<node_group_name>" {
            ...
            timeouts {
              create = "1h30m"
              update = "1h30m"
              delete = "60m"
            }
          }
          ```
          
          {% endcut %}
          
          {% endnote %}

      For more information, see [this Terraform provider guide](../../terraform/resources/kubernetes_node_group.md).

    - API {#api}

      {% note info %}
      
      Below, see parameters for the REST API request body. To specify a parameter in a gRPC API call, convert its name from [lower CamelCase](https://en.wikipedia.org/wiki/Camel_case) to [snake_case](https://en.wikipedia.org/wiki/Snake_case), e.g., `minResourcePresetId` becomes `min_resource_preset_id`.
      
      {% endnote %}

      1. Get all existing metadata for a node group using one of the following methods:
         
         * Use the [get](../managed-kubernetes/api-ref/NodeGroup/get.md) REST API method for the [NodeGroup](../managed-kubernetes/api-ref/NodeGroup/index.md) resource.
         * Use the [NodeGroupService/Get](../managed-kubernetes/api-ref/grpc/NodeGroup/get.md) API call.
         
         In your request, provide the node group ID in the `nodeGroupId` parameter. You can get the ID with the [list of node groups in the folder](node-group/node-group-list.md#list).
         
         The metadata will be listed as `key=value` pairs in the `nodeTemplate.metadata` field of the response.

      1. Use the [update](../managed-kubernetes/api-ref/NodeGroup/update.md) REST API method for the [NodeGroup](../managed-kubernetes/api-ref/NodeGroup/index.md) resource or the [NodeGroupService/Update](../managed-kubernetes/api-ref/grpc/NodeGroup/update.md) gRPC API call, and provide the following in the request:

          * Node group ID in the `nodeGroupId` parameter.

          * `updateMask` parameter set to `nodeTemplate.metadata`.

            {% note warning %}
            
            The API method will assign default values to all the parameters of the object you are modifying unless you explicitly provide them in your request. To avoid this, list the settings you want to change in the `updateMask` parameter as a single comma-separated string.
            
            {% endnote %}

          * `nodeTemplate.metadata` parameter listing all current node group metadata as `key=value` pairs without any changes.

            For the `enable-oslogin` key, replace the current value with `true`. If there is no such key, add it.

            {% note warning %}
            
            If access via OS Login is enabled, access using SSH keys will not be possible.
            
            {% endnote %}

            {% cut "Example of listing metadata in a parameter" %}

            > * Current metadata keys in a node group:
            >
            >   ```json
            >   "nodeTemplate": {
            >       "metadata": {
            >           "enable-oslogin": "undefined",
            >           "<current_key_1>": "<current_value_1>",
            >           "<current_key_2>": "<current_value_2>"
            >       },
            >       ...
            >   }
            >   ```
            >
            > * Metadata keys to provide in an API request:
            >
            >   ```json
            >   "nodeTemplate": {
            >       "metadata": {
            >           "enable-oslogin": "true",
            >           "<current_key_1>": "<current_value_1>",
            >           "<current_key_2>": "<current_value_2>"
            >       }
            >   }
            >   ```

            {% endcut %}

            {% note alert %}
            
            Metadata not listed in `nodeTemplate.metadata` will be deleted.
            
            Then the node group status will temporarily change to **Reconciling**: all the nodes in the group will be recreated for the changes to apply.
            
            {% endnote %}

    {% endlist %}

## Connect to the node using the CLI {#connect-via-cli}

1. View the description of the CLI command for connecting to the node:

    ```bash
    yc compute ssh --help
    ```

1. To find out the name of the node you need, get a list of cluster nodes:

    ```bash
    yc managed-kubernetes node-group list-nodes --name <node_group_name>
    ```

    Result example:

    ```bash
    +----------------------+-----------------+---------------------------+-------------+--------+
    | CLOUD INSTANCE       | KUBERNETES NODE | RESOURCES                 | DISK        | STATUS |
    +----------------------+-----------------+---------------------------+-------------+--------+
    | fhmmh23ugigb******** | <node_name>      | 4 100% core(s), 8.0 GB of | 64.0 GB ssd | READY  |
    | RUNNING_ACTUAL       |                 | memory                    |             |        |
    +----------------------+-----------------+---------------------------+-------------+--------+
    ```

1. Connect to the node:

    ```bash
    yc compute ssh --name <node_name>
    ```

    {% note info %}

    For service accounts, [OS Login profiles](../../organization/concepts/os-login.md#os-login-profiles) are not created automatically. To connect to a VM or Kubernetes node on behalf of a service account, you need to [manually create](../../organization/operations/os-login-profile-create.md) an OS Login profile.

    {% endnote %}

## Connect to the node over SSH {#connect-via-ssh}

1. [Export the OS Login certificate](../../compute/operations/vm-connect/os-login-export-certificate.md).

   {% note info %}

   The certificate is valid for one hour. Afterwards, you will need to export a new certificate to connect to the node.

   {% endnote %}

1. Find out the public address of the node:

   1. Get the node group ID:

      ```bash
      yc managed-kubernetes node-group list
      ```

      Result:

      ```text
      +------------------------------+----------------------+-----------+----------------------+---------------------+---------+------+
      |          ID                  |      CLUSTER ID      |   NAME    |  INSTANCE GROUP ID   |     CREATED AT      | STATUS  | SIZE |
      +------------------------------+----------------------+-----------+----------------------+---------------------+---------+------+
      | <node_group_ID> | cato4gqs0ave******** | ng-name   | cl17a1c3mbau******** | 2024-02-08 04:25:06 | RUNNING |    1 |
      +------------------------------+----------------------+-----------+----------------------+---------------------+---------+------+
      ```

      You will find the parameter you need in the `ID` column.

   1. View the list of Managed Service for Kubernetes nodes that belong to this group:

      ```bash
      yc compute instance-group list-instances <node_group_ID>
      ```

      Result:

      ```text
      +----------------------+---------------------------+----------------+-------------+----------------------+----------------+
      |     INSTANCE ID      |           NAME            |  EXTERNAL IP   | INTERNAL IP |        STATUS        | STATUS MESSAGE |
      +----------------------+---------------------------+----------------+-------------+----------------------+----------------+
      | fhm8nq5p7t0r******** | cl12kvrgj493rhrkimmb-**** | 84.201.156.211 | 10.128.0.36 | RUNNING_ACTUAL [25m] |                |
      +----------------------+---------------------------+----------------+-------------+----------------------+----------------+
      ```

      The public IP address of the Managed Service for Kubernetes node is listed in the `EXTERNAL IP` column.

1. Connect to the VM:

    ```bash
    ssh -i <path_to_certificate_file> <user_login>@<node_public_IP_address>
    ```

    Where:

    * `<path_to_certificate_file>`: Path to the certificate's `Identity` file you saved earlier, e.g., `/home/user1/.ssh/yc-cloud-id-b1gia87mbaom********-orgusername`.
    * `<user_login>`: User login as set in their [OS Login profile](../../organization/concepts/os-login.md#os-login-profiles). This login is also specified at the end of the name of the exported OS Login certificate. In the example above, it is `orgusername`.

        {% note info %}

        For service accounts, [OS Login profiles](../../organization/concepts/os-login.md#os-login-profiles) are not created automatically. To connect to a VM or Kubernetes node on behalf of a service account, you need to [manually create](../../organization/operations/os-login-profile-create.md) an OS Login profile.

        {% endnote %}

    * `<node_public_IP_address>`: Public IP address of the node obtained earlier.

    If this is your first time connecting to the node, you will get an unknown host warning:

    ```text
    The authenticity of host '158.160.**.** (158.160.**.**)' can't be established.
    ECDSA key fingerprint is SHA256:PoaSwqxRc8g6iOXtiH7ayGHpSN0MXwUfWHk********.
    Are you sure you want to continue connecting (yes/no)?
    ```

    Type `yes` into the terminal and press **Enter**.