Skip to main content
Welcome to this lesson on kubeconfig files in Kubernetes. In this session, we will dive into certificate-based authentication using both curl and kubectl, and demonstrate how a kubeconfig file simplifies access management across multiple clusters.

​
Certificate Authentication with curl and kubectl

Previously, we generated a certificate for a user and utilized the certificate along with a key to query the Kubernetes REST API for a list of pods. For instance, if your cluster is named “my kube playground,” you can make a curl request to the API server as follows:
The API server then returns a response similar to this:
Likewise, when using the kubectl command-line tool, you can supply the same parameters:
The response in this case might be:
Instead of typing these options each time, streamline your workflow by moving them into a kubeconfig file.

​
Understanding the Kubeconfig File

By default, kubectl searches for a kubeconfig file named “config” in the ~/.kube directory. Once properly set up, you can simply execute:
and kubectl will automatically use the configurations defined within the file. The kubeconfig file is organized into three key sections:
  • Clusters: Define the Kubernetes clusters you need access to (e.g., development, production, or clusters hosted by different cloud providers).
  • Users: Specify the user accounts and associated credentials (such as admin, dev, or prod users) that have permissions on the clusters.
  • Contexts: Link a cluster with a user by specifying which user should access which cluster. A context can also define a default namespace.
Below is an example of a basic kubeconfig file in YAML format:
In this configuration, the server specification for the “my kube playground” cluster is defined in the clusters section, the admin user’s credentials are listed in the users section, and the context named my-kube-admin@my-kube-playground ties them together. Multiple contexts can be created for different clusters and users, and you can set a default context using the current-context field.

​
Viewing and Customizing Your Kubeconfig

To view the current kubeconfig settings, run:
This command outputs details about clusters, users, contexts, and the active context. An example output might look like:
If you want to view a custom kubeconfig file, use the --kubeconfig option:
A sample custom configuration may appear as follows:
To change the active context—for example, switching from the admin user to the production user—execute:
After running this command, the kubeconfig is updated accordingly. The new configuration might look like this:
Additional kubectl config commands can be used to update or delete entries as needed.

​
Configuring Default Namespaces

Namespaces in Kubernetes help segment clusters into multiple virtual clusters. You can configure a context to automatically use a specific namespace. Consider the following kubeconfig snippet without a default namespace:
To specify a default namespace (for example, “finance”), simply add the namespace field:
When you switch to this context, kubectl will automatically operate within the specified namespace.

​
Managing Certificates in Kubeconfig Files

For best practices, use full paths for certificate files in your kubeconfig file. Alternatively, you can embed the certificate data directly using the certificate-authority-data field.
For instance, specifying a full path looks like this:
Alternatively, you may embed the certificate data directly:
To decode base64 encoded certificate data, use the following command:
The decoded output will resemble:

​
Conclusion

This concludes our detailed exploration of kubeconfig files in Kubernetes. Use these best practices and examples to manage your clusters efficiently and troubleshoot any configuration issues you may encounter. For further learning, explore the following resources: Transcribed by https://otter.ai

Watch Video

Practice Lab