Skip to main content
This lesson walks through inspecting kubeconfig files, switching contexts, and troubleshooting a client-certificate mismatch that causes kubectl authentication failures. You’ll learn how to view kubeconfig contents, compare multiple kubeconfigs, switch contexts (including using --kubeconfig), make a kubeconfig the default, and fix credential path typos using kubectl config set-credentials.

​
Locate the default kubeconfig

First, confirm the home directory and the default kubeconfig location.
The default kubeconfig file is normally ~/.kube/config (here: /root/.kube/config).
Quick summary for this default kubeconfig:

​
Inspect an alternate kubeconfig: /root/my-kube-config

A separate kubeconfig file exists at /root/my-kube-config. Review its contents:
Summary for /root/my-kube-config:

​
Switch context to use dev-user on test-cluster-1

The research context maps dev-user to test-cluster-1. To use that context from the alternate kubeconfig, tell kubectl which kubeconfig to operate on using --kubeconfig (the default kubectl config operations target ~/.kube/config unless you specify otherwise). Switch the context in /root/my-kube-config:
Confirm the active context inside that kubeconfig:

​
Make /root/my-kube-config the default kubeconfig

To avoid repeatedly specifying --kubeconfig, move /root/my-kube-config to the default location ~/.kube/config:
Now kubectl will use this kubeconfig by default.

​
Troubleshoot access to the cluster

With the default kubeconfig set and current-context as research (mapping dev-user to test-cluster-1), attempting to list nodes returns an authentication error:
This indicates a credentials issue. Inspect the dev-user credentials referenced by the active kubeconfig:
Check the files actually present on disk for dev-user:
Problem identified: the kubeconfig references /etc/kubernetes/pki/users/dev-user/developer-user.crt (a filename typo: developer-user.crt), but the actual certificate file is dev-user.crt. This filename mismatch prevents TLS client authentication.

​
Fix the certificate path in the kubeconfig

Use kubectl config set-credentials to correct dev-user and point it to the actual certificate and key files:
Verify the updated kubeconfig (minified view to show the active context and user mapping):
Retry the kubectl command to validate access:
After correcting the certificate paths, kubectl authenticates successfully using the dev-user credentials in the research context.
If you need to operate on a non-default kubeconfig, use the --kubeconfig flag. To make a kubeconfig the default for all kubectl commands, place it at ~/.kube/config.

Watch Video