Your new cluster (the workload cluster) has its own credentials, separate from the management cluster you have been using so far. Fetch its kubeconfig and confirm you can reach it.

## Prerequisites

- A cluster whose Machines all show `Running`. Complete [Create your first cluster](/docs/hetzner/apalla/getting-started/create-your-first-cluster) first.

## Fetch the kubeconfig

Syself Autopilot stores the workload cluster's credentials as a kubeconfig file in a secret in the management cluster. Fetch it:

<Tabs id="shell" items={['bash/zsh', 'PowerShell']}>
<TabItem value="bash/zsh">

```console
$ kubectl get secrets mycluster-kubeconfig \
  -o=jsonpath='{.data.value}' \
  | base64 -d \
  > mycluster-kubeconfig.yaml
```

</TabItem>
<TabItem value="PowerShell">

```powershell
kubectl get secrets mycluster-kubeconfig -o=jsonpath='{.data.value}' |
  ForEach-Object { [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($_)) } |
  Set-Content -Encoding utf8 mycluster-kubeconfig.yaml
```

</TabItem>
</Tabs>

Test the connection:

```console
$ kubectl --kubeconfig=mycluster-kubeconfig.yaml get nodes
```

## Point kubectl at the workload cluster

From here on you hold two kubeconfigs, and every command goes to whichever cluster its kubeconfig points at:

```mermaid
flowchart LR
  K1["Management kubeconfig<br/>from Syself"] --> M["Management cluster<br/>create and inspect Cluster objects"]
  K2["mycluster-kubeconfig.yaml<br/>fetched above"] --> W["Workload cluster<br/>deploy and run your apps"]
```

The rest of this walkthrough targets the workload cluster, so switch your default context to it instead of typing `--kubeconfig` on every command:

<Tabs id="shell" items={['bash/zsh', 'PowerShell']}>
<TabItem value="bash/zsh">

```console
$ export KUBECONFIG=$(pwd)/mycluster-kubeconfig.yaml
```

</TabItem>
<TabItem value="PowerShell">

```powershell
$env:KUBECONFIG = "$(Get-Location)\mycluster-kubeconfig.yaml"
```

</TabItem>
</Tabs>

This sets `KUBECONFIG` to an absolute path, so it keeps working even if you change directories later. It only lasts for your current terminal session: close the terminal, or open a new one, and every `kubectl` command for the rest of this walkthrough falls back to the management cluster's kubeconfig, or nothing at all, until you run this again. Stay in the same terminal for the rest of the guide, or re-run this line in each new one you open.

## Confirm the nodes are ready

```console vars
$ kubectl get nodes
NAME                          STATUS   ROLES           AGE   VERSION
mycluster-abc12-xyz01         Ready    control-plane   10m   v1.36.3
mycluster-abc12-xyz02         Ready    control-plane   9m    v1.36.3
mycluster-abc12-xyz03         Ready    control-plane   8m    v1.36.3
mycluster-md-0-def34-xyz04    Ready    <none>          7m    v1.36.3
```

You may see nodes in `NotReady` for a minute while the system pods finish starting. Wait until every node shows `Ready` before moving on.

## Next step

With `KUBECONFIG` pointed at your workload cluster and every node `Ready`, continue with [Explore your cluster](/docs/hetzner/apalla/getting-started/explore-your-cluster) to see what Syself Autopilot installed for you and confirm the cluster is healthy.

## Related

- [Explore your cluster](/docs/hetzner/apalla/getting-started/explore-your-cluster)
- [Concepts: management and workload clusters](/docs/hetzner/apalla/concepts/foundations/management-and-workload-clusters)