Kubernetes Multi-Cluster Management with Portainer

Let's be honest: when a company's infrastructure grows to include a second Kubernetes cluster, managing everything via kubectl stops being convenient. Every engineer stores kubeconfig files, switches between contexts, and the situation gets even more complex with a mixed infrastructure (K8s + Docker Compose). We've encountered this many times and found a solution — Portainer. This tool fills the niche between Lens (a developer's tool) and Rancher (an enterprise platform): it's a web interface accessible to the entire team, working equally well with Kubernetes and Docker environments. Over 5 years, we've configured Portainer for 15+ companies — from startups to enterprises with 10+ clusters. Our experience lets us deploy multi-cluster management in 1-2 days with guaranteed fault tolerance. If you need centralized management, contact us — we'll assess your infrastructure and suggest the optimal configuration.

Portainer vs. Lens and Rancher

Lens is great for developers: fast, local, but requires installation on every machine. Rancher is powerful but complex to set up and resource-intensive. Portainer is the sweet spot: a simple UI running in a browser, capable of managing both Kubernetes and Docker. It's ideal for teams of up to 20 people who don't need enterprise SSO. In our estimation, Portainer sets up 3 times faster than Rancher — 2 hours instead of 6.

How Portainer Manages Multiple Clusters

Architecture: Server and Agent

Portainer consists of two components:

Portainer Server — the main service with a web interface. Installed once, usually in a separate Kubernetes namespace or on a Docker host.

Portainer Agent — a lightweight agent installed in each managed cluster or on a Docker host. The agent opens a secure reverse connection back to the Server.

This is a key difference from Lens: Portainer is accessible via URL to any user with a browser, no installation on the local machine required.

Server Installation and Cluster Connection: Step by Step

1. Install Portainer Server in Kubernetes using Helm:

helm repo add portainer https://portainer.github.io/k8s/
helm install portainer portainer/portainer \
  --namespace portainer \
  --create-namespace \
  --set service.type=LoadBalancer \
  --set tls.force=true

2. Get the server URL (e.g., https://portainer.example.com).

3. In the Portainer interface, go to Environments → Add Environment → Kubernetes.

4. Choose the connection method: Agent or kubeconfig. If you choose Agent, Portainer will generate a manifest for kubectl.

5. Apply the manifest to the target cluster: kubectl apply -f portainer-agent.yaml.

6. Within a minute, the cluster will appear in the Environments list — ready for management.

The entire process of connecting one cluster takes about 15 minutes.

What Portainer Can Do with Kubernetes

Through the web interface, you can:

• Manage Namespaces with Resource Quotas and Limit Ranges
• Deploy applications via form or YAML manifest
• Manage Deployments, Services, Ingresses, ConfigMaps, Secrets
• View pod logs in real time
• Execute commands in containers directly from the browser
• Manage Helm Charts via built-in App Templates

Portainer Business adds RBAC on top of standard Kubernetes RBAC — this is important for organizations where you need to limit developers to specific namespaces without configuring complex ClusterRoles.

Docker Environments in One Interface

This is something neither Lens nor Rancher offers in such a convenient form. If some services still run on Docker Compose (legacy hosts, dev environments), Portainer manages them alongside Kubernetes clusters. A single window for deploying a stack in Docker Compose and a Helm release in Kubernetes.

Install the Portainer Agent on a Docker host:

docker run -d \
 -p 9001:9001 \
 --name portainer_agent \
 --restart always \
 -v /var/run/docker.sock:/var/run/docker.sock \
 -v /var/lib/docker/volumes:/var/lib/docker/volumes \
 portainer/agent:latest

The host then appears in the Environments list next to Kubernetes clusters.

Security and Limitations

Portainer Business supports OAuth2/OIDC and LDAP for SSO. Community Edition only supports local users or LDAP.

The Portainer Agent requires broad cluster-level privileges (ClusterAdmin) for full management functionality. This is a trade-off: convenience comes at the cost of elevated agent permissions. If you need minimal privileges, use read-only mode or restrict the Agent to specific namespaces, but functionality will be limited.

Portainer Server stores tokens and credentials in its own database (BoltDB or external DB). If the database is lost, all environment configurations are lost. Therefore, we always configure database backups to S3 or use an external PostgreSQL database.

Configuring RBAC in Portainer Business for Developers

Enable external authentication (LDAP/OIDC), create teams based on provider groups, and assign each team access only to specific environments and namespaces. This way, developers see only their pods and logs, without access to the production cluster. In Portainer Business, you can map LDAP roles to teams, centralizing rights management.

When to Use Portainer

Portainer is a good choice if:

• The team is small (up to 20 people) and doesn't need enterprise SSO
• The infrastructure includes a mix of Kubernetes and Docker
• You need a simple UI without the complexity of setting up Rancher
• You want to give developers quick access to view the status of their applications without kubectl

For large enterprises with hundreds of developers and dozens of clusters, Rancher offers more advanced management and GitOps integration. But even in such cases, Portainer can be useful as an additional tool for quick access.

What's Included in Our Work

Order a turnkey Portainer setup and get a unified management window in 1-2 days. The service includes:

• Installation and configuration of Portainer Server (Kubernetes or Docker)
• Deployment of Portainer Agent in all clusters and Docker hosts
• Configuration of TLS, LDAP/OIDC, RBAC
• Creation of teams and access rights for developers
• Integration with Git repositories via App Templates
• Backup of the Portainer database
• Documentation and team training

We guarantee stable performance under load. If you have a complex infrastructure, reach out — we'll perform an audit and suggest the optimal architecture. Contact us to discuss your project.

Timelines and Cost

Setup time: from 1 to 3 days, depending on the number of clusters and security requirements. Cost is calculated individually — submit a request, and we'll evaluate the project and offer a fixed price.

Portainer is an open-source tool used in production environments.