Getting Access & LBNL SSO

Access to the Berkelium Kubernetes Cluster is open to all Lawrence Berkeley National Laboratory (LBNL) staff, scientists, postdocs, and affiliated guest researchers.

Prerequisites

An active LBNL OneID / LDAP credential (@lbl.gov email address).
A principal investigator (PI) or project grant reference (LDRD, DOE Office of Science, NIH, etc.).
Installed Kubernetes CLI tools (kubectl and kubelogin).

Navigate to the Berkelium User Portal Login page. You can authenticate using LBNL OneID Single Sign-On (SSO) or your institutional LDAP credentials.

Upon your first sign-in:

Your identity is verified against Berkeley Lab Shibboleth directory.
An institutional user profile is initialized for your division.

Step 2: Request or Create a Project Namespace

Compute resources on Berkelium are scoped within Namespaces. Each research team or project operates inside an isolated namespace with its own dedicated CPU, memory, GPU, and storage quotas.

Go to the Self-Service Namespace Portal.
Click Create Namespace.
Choose a name prefix (sci-<your-project>) adhering to Kubernetes RFC 1123 naming rules.
Select an allocation tier:
- Development & Prototyping (4 CPU, 16GB RAM, 50GB storage)
- Standard Scientific Compute (16 CPU, 64GB RAM, 250GB storage)
- GPU Accelerated Research (32 CPU, 128GB RAM, 2x GPUs, 1TB storage)
- Custom Heavy Allocation (Custom limits up to 128 Cores / 8 GPUs)
Submit the form to provision your namespace immediately.

Step 3: Configure `kubectl` and `kubelogin`

To control workloads from your local terminal or a remote lab server, you need the OpenID Connect credential helper.

macOS (via Homebrew)

brew install kubectl
brew install int128/kubelogin/kubelogin

Linux (Ubuntu / Debian / RedHat)

# Install kubectl
sudo curl -fsSL -o /usr/local/bin/kubectl https://dl.k8s.io/release/v1.31.0/bin/linux/amd64/kubectl
sudo chmod +x /usr/local/bin/kubectl

# Install kubelogin (OIDC helper)
curl -fsSL https://github.com/int128/kubelogin/releases/download/v1.30.1/kubelogin_linux_amd64.zip -o kubelogin.zip
unzip kubelogin.zip && sudo mv kubelogin /usr/local/bin/kubectl-oidc_login

Step 4: Download Your Kubeconfig

Go to the CLI & Kubeconfig Generator.
Select your provisioned namespace from the dropdown.
Click Download File and place it in your ~/.kube/config path:

mkdir -p ~/.kube
mv ~/Downloads/berkelium-sci-myproject-config.yaml ~/.kube/config
chmod 600 ~/.kube/config

Test connectivity to Berkelium:

kubectl get pods -n sci-myproject

Your browser will automatically open to authenticate your LBNL credentials, confirming cluster access!