---
title: "To deploy nodes"
url: "https://docs.yugabyte.com/stable/yugabyte-platform/prepare/cloud-permissions/cloud-permissions-nodes-k8s/"
---

# To deploy nodes

Prepare your cloud for deploying universe nodes using a Kubernetes provider configuration.

Prepare your cloud for deploying YugabyteDB universe nodes

- [On-premises](/stable/yugabyte-platform/prepare/cloud-permissions/cloud-permissions-nodes/)
- [AWS](/stable/yugabyte-platform/prepare/cloud-permissions/cloud-permissions-nodes-aws/)
- [GCP](/stable/yugabyte-platform/prepare/cloud-permissions/cloud-permissions-nodes-gcp/)
- [Azure](/stable/yugabyte-platform/prepare/cloud-permissions/cloud-permissions-nodes-azure/)
- [OCI](/stable/yugabyte-platform/prepare/cloud-permissions/cloud-permissions-nodes-oci/)
- [Kubernetes](/stable/yugabyte-platform/prepare/cloud-permissions/cloud-permissions-nodes-k8s/)

For YugabyteDB Anywhere (YBA) to deploy and manage YugabyteDB universes on Kubernetes, you need to provide YBA with a service account that can create and manage pods, services, StatefulSets, secrets, and related resources in the target namespaces. The more permissions that you can provide, the more YBA can automate.

## Kubernetes

As a prerequisite for creating pods and deploying database clusters, YBA requires a service account in the Kubernetes cluster and a corresponding kubeconfig file.

Do one of the following:

- Create a [`yugabyte-platform-universe-management` service account](#create-a-service-account "yugabyte-platform-universe-management service account") and a [`kubeconfig` file](#create-a-kubeconfig-file "kubeconfig file") directly.
  
  Do this for each Kubernetes cluster if you are doing a multi-cluster setup. Prefer this approach when you need least-privilege access (for example, Namespace Restricted), because the YBA installation service account may not have the permissions required to manage universes.
- If deploying into a single Kubernetes cluster **and** the service account used for your YBA installation already has sufficient permissions to manage universes, have YBA auto-fill these values using that service account and kubeconfig.
  
  See [Create a provider](/stable/yugabyte-platform/configure-yugabyte-platform/kubernetes/ "Create a provider") for details.

### Create a service account

YBA uses a kubeconfig generated for this service account to authenticate to the Kubernetes cluster. Do not delete the account after YBA starts using it.

Set the `YBA_NAMESPACE` environment variable to the namespace where you will create the service account. This is commonly the namespace where YBA is installed, but it can be any namespace.

```sh
export YBA_NAMESPACE="yb-platform"
```

Note that the `YBA_NAMESPACE` variable is used in the commands throughout this document.

Run the following `kubectl` command to apply the YAML file:

```sh
export YBA_NAMESPACE="yb-platform"

kubectl apply -f https://raw.githubusercontent.com/yugabyte/charts/master/rbac/yugabyte-platform-universe-management-sa.yaml -n ${YBA_NAMESPACE}
```

Expect the following output:

```output
serviceaccount/yugabyte-platform-universe-management created
```

The next step is to grant access to this service account using ClusterRoles and Roles, as well as ClusterRoleBindings and RoleBindings, so it can manage YugabyteDB universe resources.

In the RBAC manifests, `<SA_NAMESPACE>` is the namespace where the service account lives (the value of `YBA_NAMESPACE`). For Namespace Admin and Namespace Restricted, that is separate from the *target* namespaces where you deploy universes; those are set with `kubectl apply -n`.

The tasks you can perform depend on your access level.

**Global Admin** can grant broad cluster-level admin access by executing the following command:

```sh
export YBA_NAMESPACE="yb-platform"

curl -s https://raw.githubusercontent.com/yugabyte/charts/master/rbac/platform-global-admin.yaml \
  | sed "s/namespace: <SA_NAMESPACE>/namespace: ${YBA_NAMESPACE}/g" \
  | kubectl apply -f -
```

**Global Restricted** can grant access to only the specific cluster roles required to create and manage YugabyteDB universes across all namespaces in a cluster. The `platform-global.yaml` manifest contains ClusterRoles and ClusterRoleBindings for the required set of permissions.

```sh
export YBA_NAMESPACE="yb-platform"

curl -s https://raw.githubusercontent.com/yugabyte/charts/master/rbac/platform-global.yaml \
  | sed "s/namespace: <SA_NAMESPACE>/namespace: ${YBA_NAMESPACE}/g" \
  | kubectl apply -f -
```

**Namespace Admin** can grant namespace-level admin access. Contains a RoleBinding that grants the `cluster-admin` ClusterRole to the service account in each target namespace.

Apply the YAML in each target namespace where you want to deploy universes. For example, to grant namespace-level admin access in `yb-db-demo` and `yb-db-us-east4-a`:

```sh
export YBA_NAMESPACE="yb-platform"

for ns in yb-db-demo yb-db-us-east4-a; do
  curl -s https://raw.githubusercontent.com/yugabyte/charts/master/rbac/platform-namespaced-admin.yaml \
    | sed "s/namespace: <SA_NAMESPACE>/namespace: ${YBA_NAMESPACE}/g" \
    | kubectl apply -n "${ns}" -f -
done
```

**Namespace Restricted** can grant access to only the specific roles required to create and manage YugabyteDB universes in a particular namespace. Contains Roles and RoleBindings for the required set of permissions.

As with Namespace Admin, apply the YAML in each target namespace. For example, if your goal is to allow YBA to manage YugabyteDB universes in the namespaces `yb-db-demo` and `yb-db-us-east4-a`, apply in both target namespaces as follows:

```sh
export YBA_NAMESPACE="yb-platform"

for ns in yb-db-demo yb-db-us-east4-a; do
  curl -s https://raw.githubusercontent.com/yugabyte/charts/master/rbac/platform-namespaced.yaml \
    | sed "s/namespace: <SA_NAMESPACE>/namespace: ${YBA_NAMESPACE}/g" \
    | kubectl apply -n "${ns}" -f -
done
```

### Create a kubeconfig file

You can create a `kubeconfig` file for the previously created `yugabyte-platform-universe-management` service account as follows.

The `-n` argument must be the namespace where the service account was created (`YBA_NAMESPACE`), not a target universe namespace.

1. Run the following `wget` command to get the Python script for generating the `kubeconfig` file:
   
   ```sh
   wget https://raw.githubusercontent.com/yugabyte/charts/master/stable/yugabyte/generate_kubeconfig.py
   ```
2. Run the following command to generate the `kubeconfig` file. The script creates a service account token secret (required on Kubernetes 1.24 and later) and writes a kubeconfig that uses that token:
   
   ```sh
   export YBA_NAMESPACE="yb-platform"
   
   python3 generate_kubeconfig.py -s yugabyte-platform-universe-management -n ${YBA_NAMESPACE}
   ```
   
   Expect the following output:
   
   ```output
   Generated the kubeconfig file: /tmp/yugabyte-platform-universe-management.conf
   ```
3. Use this generated `kubeconfig` file for your Kubernetes provider configuration.

| Save for later  | To configure                                                                                  |
|-----------------|-----------------------------------------------------------------------------------------------|
| kubeconfig file | [Kubernetes provider](/stable/yugabyte-platform/configure-yugabyte-platform/kubernetes/ "Kubernetes provider") |