Skip to main content
Mount Thor provides a Kubernetes interface for managing bare-metal Macs and macOS virtual machines at scale. This interface runs in parallel with the mthr CLI: use Kubernetes resources for declarative or large-scale management, or use mthr as a convenient command-line workflow. Your compute resources appear in your tenant namespace as Kubernetes objects, so you can manage them with ordinary kubectl commands:
  • virtualmachines: your macOS virtual machines.
  • baremetalmachines: your allocated bare-metal Macs.
Both are custom resources in the compute.mountthor.com API group. List and inspect them like any other Kubernetes object, with commands such as kubectl get virtualmachines or kubectl get baremetalmachines. Your role’s permissions decide what you can do with them. Before provisioning compute, set up your billing information and top up your prepaid balance in the Mount Thor portal.

​
Generate a kubeconfig

Sign in first, then write the kubeconfig to a path:
A valid session is required to create the credential. Omit --out to be prompted for a path. The default is ~/.kube/mount-thor. Use --out - to write the kubeconfig to stdout.

​
Use it

Point kubectl at the generated file:
Or pass it per command with kubectl --kubeconfig ~/.kube/mount-thor. The kubeconfig’s default namespace is your tenant’s namespace (mthr-<tenant>), so bare commands target the right place without -n.

​
Provision a bare-metal Mac

Create my-mac.yaml:
Apply the request and watch until the machine is ready:
When it is ready, connect with the CLI:
You can also use mthr bm desktop my-mac for desktop access. The CLI opens the connection locally and keeps the access session active while the command runs. Delete the resource to release the Mac:

​
Provision a virtual machine

You reach a VM through mthr with your Mount Thor identity, and the CLI grants temporary access to it. A VM manifest takes no SSH keys.
Apply the request and watch until the VM is running:
Connect to the VM using your Mount Thor identity:
You can also use mthr vm desktop my-vm for desktop access. See Virtual machines for the VM preview and connection details. Delete the resource when finished:

​
Staying signed in

The kubeconfig file does not expire. It embeds an exec credential plugin that refreshes your access automatically in the background, so kubectl keeps working without regenerating the file.

​
Binary path

By default the embedded exec plugin invokes mthr by name, so mthr must be on your $PATH for kubectl to work. For installs where it is not, bake an explicit path into the kubeconfig:
You can also set the path with the MOUNTTHOR_KUBECONFIG_EXEC_COMMAND environment variable.

​
Credentials and revocation

The kubeconfig file does not contain a secret. The exec plugin supplies a short-lived client certificate to kubectl on demand. Revoke the Kubernetes access session and clear the cached credential with:

​
Permissions

Generating a kubeconfig and authenticating does not by itself grant permissions inside the cluster. What you can do is governed by your assigned role. If kubectl returns Forbidden, that is an authorization matter for your role, not a problem with the kubeconfig. For the CLI workflow, see Bare metal or Virtual machines.