Each cluster you create (a workload cluster) has its own credentials, separate from the management cluster. Fetch its kubeconfig, point `kubectl` at it, and confirm you can reach it.

## Prerequisites

- A cluster whose Machines all show `Running`. See [Create a cluster](/docs/hetzner/apalla/clusters/create/create-a-cluster).

In the commands below, `<name>` is the cluster name and `<namespace>` is your organization's namespace on the management cluster, in the format `org-<company-name>`.

## Fetch the kubeconfig

Syself Autopilot stores the cluster's credentials as a kubeconfig in the secret `<name>-kubeconfig` in your namespace.

> [!WARNING]
> This kubeconfig has full admin rights on the cluster, and you can't revoke or replace it on an existing cluster. Anyone who gets a copy keeps admin access. Keep it out of Git and don't share it. To give people their own logins, set up [OIDC](/docs/hetzner/apalla/clusters/configure/configure-oidc).

Fetch it:

<Tabs id="shell" items={['bash/zsh (Linux/macOS)', 'PowerShell (Windows)']}>
<TabItem value="bash/zsh (Linux/macOS)">

```console
$ kubectl get secrets <name>-kubeconfig -n <namespace> \
  -o=jsonpath='{.data.value}' \
  | base64 -d \
  > <name>-kubeconfig.yaml
```

</TabItem>
<TabItem value="PowerShell (Windows)">

```powershell
kubectl get secrets <name>-kubeconfig -n <namespace> -o=jsonpath='{.data.value}' |
  ForEach-Object { [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($_)) } |
  Set-Content -Encoding utf8 <name>-kubeconfig.yaml
```

</TabItem>
</Tabs>

## Point kubectl at the cluster

From here on you hold two kubeconfigs, and every command goes to whichever cluster its kubeconfig points at:

```mermaid
flowchart LR
  K1["Management kubeconfig<br/>from Syself"]:::you --> M["Management cluster<br/>create and inspect Cluster objects"]:::platform
  K2["Cluster kubeconfig<br/>fetched above"]:::you --> W["Workload cluster<br/>deploy and run your apps"]:::platform
```

Switch `kubectl` to the new cluster:

<Tabs id="shell" items={['bash/zsh (Linux/macOS)', 'PowerShell (Windows)']}>
<TabItem value="bash/zsh (Linux/macOS)">

```console
$ export KUBECONFIG=$(pwd)/<name>-kubeconfig.yaml
```

</TabItem>
<TabItem value="PowerShell (Windows)">

```powershell
$env:KUBECONFIG = "$(Get-Location)\<name>-kubeconfig.yaml"
```

</TabItem>
</Tabs>

This only lasts for the current terminal session. In a new terminal, `kubectl` goes back to your default kubeconfig, whichever cluster that points to. If you want to make this your default kubeconfig, you can move it to the `~/.kube/config` file. Before you run a command, check which cluster you are connected to with `kubectl config current-context`, so you don't run it against the management cluster by mistake, or the other way around. See [Management and Workload Clusters](/docs/hetzner/apalla/concepts/foundations/management-and-workload-clusters) for how the two fit together.

To reach the API server through your own hostname instead of the load balancer IP, see [Access a cluster through a domain](/docs/hetzner/apalla/clusters/configure/access-through-a-domain).

## Confirm the nodes are ready

```console vars
$ kubectl get nodes
NAME                          STATUS   ROLES           AGE   VERSION
mycluster-abc12-xyz01         Ready    control-plane   10m   v1.36.6
mycluster-abc12-xyz02         Ready    control-plane   9m    v1.36.6
mycluster-abc12-xyz03         Ready    control-plane   8m    v1.36.6
mycluster-md-0-def34-xyz04    Ready    <none>          7m    v1.36.6
```

A node can show `NotReady` for a minute while its system pods start. If one stays `NotReady` for more than five minutes, see [Node problem detection and conditions](/docs/hetzner/apalla/servers-and-nodes/access/node-problem-detection-and-conditions).

## Next step

With `kubectl` pointed at the cluster and every node `Ready`, continue with [Explore your cluster](/docs/hetzner/apalla/clusters/create/explore-your-cluster) to see what Syself Autopilot installed for you and confirm the cluster is healthy.

## Related

- [Explore your cluster](/docs/hetzner/apalla/clusters/create/explore-your-cluster)
- [Concepts: management and workload clusters](/docs/hetzner/apalla/concepts/foundations/management-and-workload-clusters)