Before you start with Syself Autopilot, you should install the necessary tools to interact with Kubernetes clusters. This section provides instruction on how to install kubectl and kubelogin. Make sure you have these tools installed before proceeding to the next sections.

- [kubectl](https://kubernetes.io/docs/reference/kubectl/) sends commands to Kubernetes clusters. Every step here uses it.
- [kubelogin](https://github.com/int128/kubelogin) handles the browser-based login to the Syself Autopilot management cluster. `kubectl` calls it for you; you never run it yourself.

## Install kubectl

`kubectl` is the Kubernetes command-line tool. You use it to create, inspect, and update everything in a cluster, from apps to servers.

<Tabs id="operating-systems" items={['Linux', 'macOS', 'Windows']}>
<TabItem value="Linux">

```console title="x86-64"
$ curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
$ sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
```

```console title="ARM64"
$ curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/arm64/kubectl"
$ sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl
```

> [!NOTE]
> If you do not have root access, install `kubectl` to your home directory instead:
>
> ```console
> $ chmod +x kubectl
> $ mkdir -p ~/.local/bin
> $ mv ./kubectl ~/.local/bin/kubectl
> # Make sure ~/.local/bin is in your $PATH
> ```

</TabItem>
<TabItem value="macOS">

```console title="Intel"
$ curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/amd64/kubectl"
$ chmod +x ./kubectl
$ sudo mv ./kubectl /usr/local/bin/kubectl
$ sudo chown root: /usr/local/bin/kubectl
```

```console title="Apple Silicon"
$ curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/darwin/arm64/kubectl"
$ chmod +x ./kubectl
$ sudo mv ./kubectl /usr/local/bin/kubectl
$ sudo chown root: /usr/local/bin/kubectl
```

</TabItem>
<TabItem value="Windows">

We recommend installing `kubectl` via [Chocolatey](https://chocolatey.org/). If you don't have Chocolatey yet, install it first from an **Administrator** PowerShell:

```powershell
Set-ExecutionPolicy Bypass -Scope Process -Force; [System.Net.ServicePointManager]::SecurityProtocol = [System.Net.ServicePointManager]::SecurityProtocol -bor 3072; iex ((New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'))
```

Then install `kubectl` (also from an Administrator PowerShell):

```console title="Windows"
$ choco install kubernetes-cli
```

</TabItem>
</Tabs>

For more options and package-manager install methods, see the [official kubectl documentation](https://kubernetes.io/docs/tasks/tools/#kubectl).

## Install kubelogin

`kubelogin` (also called `oidc-login`) is a `kubectl` plugin. The management cluster authenticates you with OpenID Connect (OIDC), the same standard behind most "log in with your identity provider" buttons: you log in through your browser instead of pasting a static token. `kubelogin` runs that browser flow whenever `kubectl` needs a fresh login.

On Linux and macOS, we recommend installing it with Krew, the `kubectl` plugin manager. On Windows, skip Krew. Install it directly with Chocolatey (see the Windows tab below).

### Install Krew

Krew installs and updates `kubectl` plugins.

<Steps>

<Step>Make sure git is installed</Step>

Krew needs [git](https://git-scm.com/) on your PATH.

<Step>Download and install krew</Step>

```bash
(
  set -x; cd "$(mktemp -d)" &&
  OS="$(uname | tr '[:upper:]' '[:lower:]')" &&
  ARCH="$(uname -m | sed -e 's/x86_64/amd64/' -e 's/\(arm\)\(64\)\?.*/\1\2/' -e 's/aarch64$/arm64/')" &&
  KREW="krew-${OS}_${ARCH}" &&
  curl -fsSLO "https://github.com/kubernetes-sigs/krew/releases/latest/download/${KREW}.tar.gz" &&
  tar zxvf "${KREW}.tar.gz" &&
  ./"${KREW}" install krew
)
```

<Step>Add krew to your PATH</Step>

Add this line to `~/.bashrc` or `~/.zshrc`:

```bash
export PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH"
```

Then restart your shell.

</Steps>

> [!WARNING]
> Running `export PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH"` only in your current terminal session means you lose it when you close the window. Add the line to your shell configuration file so it persists.

Check the install:

```console
$ kubectl krew version
```

The command prints Krew's version details. If your shell reports `unknown command "krew"`, the PATH line from step 3 is not active yet; restart your shell and try again.

### Install kubelogin

Install the plugin for your OS:

<Tabs id="package-managers" items={['Krew (Linux/macOS)', 'Chocolatey (Windows)']}>
<TabItem value="Krew (Linux/macOS)">

```console title="macOS, Linux, and ARM"
$ kubectl krew install oidc-login
```

</TabItem>
<TabItem value="Chocolatey (Windows)">

```console title="Windows"
# Run as Administrator
$ choco install kubelogin
```

</TabItem>
</Tabs>

If you prefer to install from a GitHub release, download the binary and place it on your PATH as `kubectl-oidc_login`.

## Verify

Check that both tools are available. `kubectl` exposes its client version behind a flag, while the `oidc-login` plugin exposes it as a subcommand instead:

```console
$ kubectl version --client
$ kubectl oidc-login version
```

Both commands print a version number and exit without an error. That is all the setup you need for now; you do not need a running cluster yet.

If `kubectl oidc-login version` fails with an unknown-command error, `kubectl` cannot find the plugin. If you installed via Krew, recheck the PATH line from the [Install Krew](#install-krew) step; if you installed via Chocolatey, confirm `choco install kubelogin` completed without errors.

## Next step

Connect to the management cluster: [Access the management cluster](/docs/hetzner/apalla/getting-started/access-the-management-cluster).

## Related

- [Getting started overview](/docs/hetzner/apalla/getting-started/overview)