A kubeconfig file lets a Kubernetes client authenticate to a cluster. A managed cluster can generate one for its root service account, which has broad access. Downloading that file gives you a way to connect, but also gives you a secret to protect. section 8.1.2 section 8.1.3
Treat a kubeconfig like a password:
- Share it only with trusted people and do not commit it to Git. section 8.1.3
- Reset its keys if you think it has been compromised. section 8.1.2 section 8.1.3
Connect kubectl to a cluster
After downloading the kubeconfig and installing kubectl, put the file at ~/.kube/config, or point KUBECONFIG to its absolute path. For a macOS, Linux, or WSL terminal session, run `export KUBECONFIG=/path/to/kubeconfig.yaml`, then `kubectl get nodes`. The environment-variable approach makes it easier to use different kubeconfig files for different projects; set it again in a new terminal session. section 8.2.3
The Kubernetes Dashboard offers another connection path: download the cluster’s kubeconfig, open the Dashboard, select Kubeconfig rather than token, and choose the downloaded file to sign in. section 8.2.1
Listing 8.2 Setting KUBECONFIG in VSCode
{
...
"settings": {
...
"terminal.integrated.env.osx": {
"KUBECONFIG": "${workspaceFolder}/.kube/kubeconfig.yaml",
"PY_PORT": "8080",
"JS_PORT": "3000"
},
"terminal.integrated.env.windows": {
"KUBECONFIG": "${workspaceFolder}\\.kube\\kubeconfig.yaml",
"PY_PORT": "8080",
"JS_PORT": "3000"
},
"terminal.integrated.env.linux": {
"KUBECONFIG": "${workspaceFolder}/.kube/kubeconfig.yaml",
"PY_PORT": "8080",
"JS_PORT": "3000"
},
}
}
The VSCode terminal settings example assigns KUBECONFIG to a project-local file path on macOS, Windows, and Linux, so terminal commands can use that project’s cluster configuration. section 8.2.3
Automated deployment needs the same access. A GitHub Actions workflow writes a kubeconfig supplied through `secrets.KUBECONFIG_SA` to `~/.kube/config`, checks Pods and Deployments with kubectl, then applies manifests and restarts the application Deployments. The kubeconfig must belong to a service account with appropriate permissions. section 8.5.2
