Get the kubeconfig of a cluster

Each cluster you create (a workload cluster) has its own credentials, separate from the management cluster. Fetch its kubeconfig, point kubectl at it, and confirm you can reach it.

Prerequisites 

• A cluster whose Machines all show Running. See Create a cluster .

In the commands below, <name> is the cluster name and <namespace> is your organization's namespace on the management cluster, in the format org-<company-name>.

Fetch the kubeconfig 

Syself Autopilot stores the cluster's credentials as a kubeconfig in the secret <name>-kubeconfig in your namespace.

Fetch it:

				$ kubectl get secrets <name>-kubeconfig -n <namespace> \
  -o=jsonpath='{.data.value}' \
  | base64 -d \
  > <name>-kubeconfig.yaml
			

				kubectl get secrets <name>-kubeconfig -n <namespace> -o=jsonpath='{.data.value}' |
  ForEach-Object { [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($_)) } |
  Set-Content -Encoding utf8 <name>-kubeconfig.yaml
			

Point kubectl at the cluster 

From here on you hold two kubeconfigs, and every command goes to whichever cluster its kubeconfig points at:

flowchart LR
  K1["Management kubeconfig<br/>from Syself"]:::you --> M["Management cluster<br/>create and inspect Cluster objects"]:::platform
  K2["Cluster kubeconfig<br/>fetched above"]:::you --> W["Workload cluster<br/>deploy and run your apps"]:::platform

Switch kubectl to the new cluster:

				$ export KUBECONFIG=$(pwd)/<name>-kubeconfig.yaml
			

				$env:KUBECONFIG = "$(Get-Location)\<name>-kubeconfig.yaml"
			

This only lasts for the current terminal session. In a new terminal, kubectl goes back to your default kubeconfig, whichever cluster that points to. If you want to make this your default kubeconfig, you can move it to the ~/.kube/config file. Before you run a command, check which cluster you are connected to with kubectl config current-context, so you don't run it against the management cluster by mistake, or the other way around. See Management and Workload Clusters for how the two fit together.

To reach the API server through your own hostname instead of the load balancer IP, see Access a cluster through a domain .

Confirm the nodes are ready 

				$ kubectl get nodes
NAME                          STATUS   ROLES           AGE   VERSION
mycluster-abc12-xyz01         Ready    control-plane   10m   v1.36.6
mycluster-abc12-xyz02         Ready    control-plane   9m    v1.36.6
mycluster-abc12-xyz03         Ready    control-plane   8m    v1.36.6
mycluster-md-0-def34-xyz04    Ready    <none>          7m    v1.36.6
			

A node can show NotReady for a minute while its system pods start. If one stays NotReady for more than five minutes, see Node problem detection and conditions .

Next step 

With kubectl pointed at the cluster and every node Ready, continue with Explore your cluster to see what Syself Autopilot installed for you and confirm the cluster is healthy.

Related 

• Explore your cluster
• Concepts: management and workload clusters