> ## Documentation Index > Fetch the complete documentation index at: https://docs.ornn.com/llms.txt > Use this file to discover all available pages before exploring further. # Get cluster access > Returns the issued access for an owned cluster. A Kubernetes cluster returns a kubeconfig, its API server endpoint, and the namespace Ornn configured for your workloads. A Slurm cluster returns its SSH login details. While a launch is still running, 404 kubernetes_credentials_not_ready or slurm_credentials_not_ready means access has not been issued yet; keep polling listClusters. 404 cluster_not_found means the cluster does not exist or is not visible to your organization, including after its teardown finishes. Access stays readable while a teardown is in progress. The kubeconfig token is issued for seven days and grants cluster-admin. Reading this endpoint again returns the same stored kubeconfig; it does not renew the token. The Ornn API key is not a Kubernetes credential. CLI equivalent, after `ornn login`. A Kubernetes cluster writes a kubeconfig; a Slurm cluster prints its SSH command. ```bash theme={null} ornn connect CLUSTER_ID --output ./ornn-kubeconfig.yaml ornn connect CLUSTER_ID --print ``` ## OpenAPI ````yaml openapi.yaml GET /v1/orchestrator/controllers/{controller_id}/access openapi: 3.1.0 info: title: Ornn compute API version: 1.0.0 description: >- Customer HTTP API for Ornn GPU capacity. It covers reserved capacity and nodes, VM and Bare Metal access, Kubernetes and Slurm clusters, SSH keys, storage volumes and GitHub repositories, private networks, monitoring, buying and selling capacity (Reserve, Market, Spot, and Relist), and billing. API keys are scoped to one organization and act with their creator's access there; account, team, and API-key management stay in the console. Most operations require an approved organization. See https://docs.ornn.com/api-keys to create a key and https://docs.ornn.com/guides/kubernetes-api for an end-to-end Kubernetes integration. Examples use fictional IDs and credentials. The info.version field identifies the contract revision, not a shared API path version. contact: email: support@ornn.com servers: - url: https://api.ornn.com description: Production security: - OrnnApiKey: [] tags: - name: Authentication - name: Reservations - name: GPU nodes - name: Clusters - name: Workers - name: Virtual machines description: >- Choose a VM disk, launch VM access on a reservation, and read each VM's status, launch progress, and SSH connection details. - name: Bare Metal description: >- Launch Bare Metal access on a reservation, read a host's readiness and SSH connection details, and reboot or hard reset it. - name: SSH keys description: >- Register public keys for your organization, choose which keys a VM or Bare Metal reservation uses, and queue key delivery to machines. Slurm clusters take organization key IDs at launch. Kubernetes API access does not use SSH keys. - name: Reserve description: >- Browse reserved-capacity listings and their terms, and post, cancel, or accept offers. Reserve listings are visible to approved organizations. - name: Market description: >- Browse relisted capacity and buy windows at the asking price, paid up front. Open to every member of your organization. - name: Spot description: >- Hourly order books for VMs with 1, 2, 4, or 8 GPUs on one node: read books, trades, and quotes, place and cancel bids, and follow fills. - name: Relist description: >- Sell whole nodes from a reservation you hold at your asking price, and manage those listings. - name: Storage description: >- Managed volumes, their files, and GitHub repository pulls. Volumes belong to the API key's creator in the key's organization. - name: Networks description: >- Organization private networks and the WireGuard configs you use to reach private machines and clusters. - name: Monitoring description: >- Machine telemetry and console logs for capacity your organization holds. Reads are limited to your reservation window. - name: Billing description: >- Invoices, billing summary, usage cost, Ornn credits, and account statements. Saving a card and paying invoices stay in the console. externalDocs: description: REST integration walkthrough url: >- https://docs.ornn.com/guides/kubernetes-access#provision-and-manage-through-rest paths: /v1/orchestrator/controllers/{controller_id}/access: get: tags: - Clusters summary: Get cluster access description: >- Returns the issued access for an owned cluster. A Kubernetes cluster returns a kubeconfig, its API server endpoint, and the namespace Ornn configured for your workloads. A Slurm cluster returns its SSH login details. While a launch is still running, 404 kubernetes_credentials_not_ready or slurm_credentials_not_ready means access has not been issued yet; keep polling listClusters. 404 cluster_not_found means the cluster does not exist or is not visible to your organization, including after its teardown finishes. Access stays readable while a teardown is in progress. The kubeconfig token is issued for seven days and grants cluster-admin. Reading this endpoint again returns the same stored kubeconfig; it does not renew the token. The Ornn API key is not a Kubernetes credential. operationId: getClusterAccess parameters: - name: controller_id in: path required: true description: Cluster id returned by create or list; not a reservation ID. schema: type: string format: uuid example: 44444444-4444-4444-8444-444444444444 responses: '200': description: Issued access. The examples use fictional credentials. content: application/json: schema: oneOf: - $ref: '#/components/schemas/KubernetesAccess' - $ref: '#/components/schemas/SlurmAccess' discriminator: propertyName: kind mapping: kubernetes: '#/components/schemas/KubernetesAccess' slurm: '#/components/schemas/SlurmAccess' examples: kubernetes: summary: Kubernetes cluster value: kind: kubernetes kubeconfig: | apiVersion: v1 kind: Config clusters: - name: k8s-22222222-2222-4222-8222-222222222222 cluster: server: https://cluster.example.com:6443 certificate-authority-data: contexts: - name: k8s-22222222-2222-4222-8222-222222222222 context: cluster: k8s-22222222-2222-4222-8222-222222222222 namespace: k8s-22222222-2222-4222-8222-222222222222 user: ornn-tenant current-context: k8s-22222222-2222-4222-8222-222222222222 users: - name: ornn-tenant user: token: endpoint: https://cluster.example.com:6443 namespace: k8s-22222222-2222-4222-8222-222222222222 slurm: summary: Slurm cluster value: kind: slurm host: 203.0.113.10 node_id: 33333333-3333-4333-8333-333333333333 port: 30022 ssh_host_key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIExampleHostKeyOnly login_user: tenant ssh_command: ssh -p 30022 tenant@203.0.113.10 login_host: 203.0.113.10 login_port: 30022 authorized_key_fingerprints: - SHA256:ExampleFingerprintOnly '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': description: >- Access has not been issued yet, or the cluster is not visible. Only the two credentials_not_ready codes mean that access is still being issued. content: application/json: schema: $ref: '#/components/schemas/Error' examples: kubernetesNotReady: summary: Kubernetes access not issued yet value: detail: code: kubernetes_credentials_not_ready message: >- Kubernetes credentials are not ready yet. The cluster is still issuing access. slurmNotReady: summary: Slurm login not issued yet value: detail: code: slurm_credentials_not_ready message: >- SSH login access is not ready yet. The Slurm scheduler is still starting. clusterNotFound: summary: Cluster absent, not visible, or torn down value: detail: code: cluster_not_found message: >- Ornn could not find that cluster. It may already be torn down. default: $ref: '#/components/responses/Error' components: schemas: KubernetesAccess: type: object required: - kind - kubeconfig - endpoint - namespace properties: kind: type: string enum: - kubernetes kubeconfig: type: string description: >- Sensitive kubeconfig YAML whose service-account token has cluster-admin rights and is issued for seven days. Store it with owner-only permissions. Reading this endpoint again returns the same token; it does not renew it. endpoint: type: string description: >- The cluster's Kubernetes API server URL. Send Kubernetes API calls here, not to api.ornn.com. namespace: type: string description: >- The namespace Ornn configured for your workloads, also the kubeconfig's default. Pods created here are scheduled onto your reserved workers and count against its GPU ResourceQuota. SlurmAccess: type: object required: - kind - host - port - login_host - login_port properties: kind: type: string enum: - slurm host: type: string description: Login host as stored when access was issued. Prefer login_host. node_id: type: - string - 'null' format: uuid description: The worker host that serves the login endpoint, when it runs on one. port: type: integer description: Login port as stored when access was issued. Prefer login_port. ssh_host_key: type: - string - 'null' description: >- The login node's ed25519 public host key. Compare it with the key SSH shows on first connection, or pin it in known_hosts. login_user: type: - string - 'null' description: Linux user for SSH login. ssh_command: type: - string - 'null' description: >- A ready-made ssh command with the login user, host, and port, when all three are known. login_host: type: string description: Host to SSH to. login_port: type: integer description: Port to SSH to. It is cluster-specific and is usually not 22. authorized_key_fingerprints: type: - array - 'null' items: type: string description: >- SHA256 fingerprints of the organization SSH keys authorized on the login node. Error: type: object properties: code: type: string detail: oneOf: - type: string - type: object required: - code - message properties: code: type: string message: type: string responses: Unauthorized: description: >- The credential is missing, invalid, revoked, or no longer belongs to a current organization member. Check the HTTP status before parsing the body. content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: >- The credential lacks access to this operation, or the organization requires approval. An API key does not bypass these checks. content: application/json: schema: $ref: '#/components/schemas/Error' Error: description: >- Unsuccessful request. Check HTTP status first. Errors may have detail.code/detail.message, a string detail and optional top-level code, or an empty/non-JSON body. 401: invalid credential; 403: access or approval required; 404: not visible or credentials not ready; 409: lifecycle conflict; 429: back off; 5xx: service failure. Inspect current state before retrying mutations. content: application/json: schema: $ref: '#/components/schemas/Error' securitySchemes: OrnnApiKey: type: http scheme: bearer bearerFormat: ornn_sk_... description: >- Create an organization API key in Account Settings > Developer. Do not send this key to the Kubernetes API server. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.