A kubeconfig tells kubectl which Kubernetes API server to contact and which credentials to use. The usual client file is ~/.kube/config; kubeadm creates it during cluster bootstrap. Its clusters entry identifies the server and certificate authority, its users entry holds authentication information, and a context links a user to a cluster. The current context selects that combination for kubectl commands. section 2.4 section 3.2
Give a user limited cluster access
To configure certificate-based access, generate a private key and certificate signing request with the username as the certificate common name and the group as its organization. Submit and approve a Kubernetes CertificateSigningRequest, then retrieve the issued certificate. Configure a kubeconfig user and create a context linking that user to the cluster. After switching to the new context, test both an allowed and a forbidden operation: the pod-reader example can list pods but cannot delete one. The kubeconfig supplies an identity; the role binding determines what that identity may do. section 3.2
When kubectl cannot reach the cluster or the expected context is missing, check the client configuration before changing cluster components:
- Inspect cat ~/.kube/config and kubectl config view. Check the API server address, certificate information, current context, and KUBECONFIG setting. section 8.2.4
- If the usual file is missing, test the control-plane copy with kubectl get no --kubeconfig /etc/kubernetes/admin.conf. It can also be copied to ~/.kube/config. section 8.2.4
- If the viewed configuration differs from the file, kubectl config view --flatten > ~/.kube/config is the given way to merge the configuration into that file. section 8.2.4
Kubeconfigs also serve cluster components. For example, /etc/kubernetes/kubelet.conf identifies the kubelet's system user and points to its client certificate and key. The controller manager and scheduler have configuration files under /etc/kubernetes too. If a component manifest points to a nonexistent kubeconfig, inspect its logs and correct the path; a scheduler example fails until its authorization kubeconfig points to /etc/kubernetes/scheduler.conf. section 2.2.1 section 8.2.5
