Console
Open SSH sessions to your VMs and kubectl shells on your Kubernetes clusters from a terminal panel inside emma AI Console.
The Console is a terminal panel inside emma AI Console. It opens two kinds of sessions: SSH into a VM, and a kubectl shell on a Kubernetes cluster. Each session is a tab, and you can have several open at once.
The Console is your terminal, not the copilot. Commands you type run immediately: there's no plan, no preview, and no confirmation step.
In a nutshell:
- SSH needs a key whose private key is stored in emma (Settings → SSH Keys)
- kubectl needs a kubeconfig (Settings → Kubeconfigs), which emma fetches for you on clusters it manages
- Both connections are made from emma's servers, not from your machine
- Opening a session requires the Member role or higher
Open a session
Page navigation — click Console in the top bar → pick a VM or cluster.
The picker lists your VMs and, under Kubernetes clusters, the clusters you can open a shell on. You can also start a session from a resource: Open console in a row's menu in Inventory, or Console on a VM's page. If the project has no VMs yet, the Console offers Deploy a VM instead.
SSH into a VM
clouduser unless you change it).SSH keys are per project. The dialog only offers keys whose private key was generated or pasted in this browser. On a new browser, paste the private key in Settings → SSH Keys again.
To connect, the VM must be running and have a public IP. Windows VMs don't take SSH sessions from the Console.
The SSH connection comes from emma's servers, using the private key emma stores encrypted for you. It doesn't come from your laptop. The VM's security group must allow inbound SSH from emma, not only from your own IP.
kubectl on a cluster
The picker shows two kinds of cluster: kubeconfigs you stored under Settings → Kubeconfigs, and clusters emma manages. The first time you open one of emma's clusters, emma fetches its kubeconfig and stores it for you. A cluster needs an active control plane before you can open a shell on it.
A kubeconfig must carry its credentials inline, as a static token or a client certificate. emma rejects
kubeconfigs that use an exec credential plugin (such as a cloud CLI token helper), an auth-provider,
or paths to files on disk.
What emma creates in your cluster
A kubectl session doesn't run on emma's servers. It runs in a pod inside your cluster. The first time you open one, emma uses the kubeconfig to create:
- a namespace
emma-console - a service account
emma-console, bound to thecluster-adminrole by a cluster role bindingemma-console-admin - a pod per user,
emma-console-<id>, withkubectlinstalled
Your session attaches to a shell in that pod. A pod lives up to 30 minutes and is reused by later sessions while it has enough time left. After that, emma replaces it with a new one.
The console pod runs with cluster-admin, so the kubeconfig you use needs enough access to create that
binding. Anyone who can open a Console session on this cluster has full control of it. The namespace, service account, and
binding stay in the cluster after your session ends. If you stop using the Console on a cluster, remove
them with kubectl delete clusterrolebinding emma-console-admin and
kubectl delete namespace emma-console.
Tabs and layout
Each session opens as a tab. The new-tab button opens the picker for another session. Closing a tab ends that session, and closing the Console panel itself ends all of them.
On a wide screen, drag the Console by its grip handle to the bottom or right edge of the window. If the emma AI chat is docked on the same edge, the two panels split it and you can resize each one. Your layout is remembered in this browser.
Who can open a session
SSH and kubectl sessions need the Member role or higher. Viewers can't open them.
The Console and the copilot
The copilot works with the same VMs and clusters without the Console. It runs SSH steps in deployment plans
and kubectl through chat, and those go through the
confirmation gate. The Console is for when you want
to type the commands yourself.
What's next
- Manage Kubernetes — import a kubeconfig and run kubectl through the copilot
- Safety & confirmations — what's gated when the copilot runs commands
- InfraMap — find the VM or cluster you want to open
Last updated on 24 Sept 2026