> ## Documentation Index > Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt > Use this file to discover all available pages before exploring further. # Lab Solution KubeConfig > Guide to inspecting and switching kubeconfig contexts, comparing files, fixing client certificate path typos, and resolving kubectl authentication failures This lesson walks through inspecting kubeconfig files, switching contexts, and troubleshooting a client-certificate mismatch that causes `kubectl` authentication failures. You'll learn how to view kubeconfig contents, compare multiple kubeconfigs, switch contexts (including using `--kubeconfig`), make a kubeconfig the default, and fix credential path typos using `kubectl config set-credentials`. ## Locate the default kubeconfig First, confirm the home directory and the default kubeconfig location. ```bash theme={null} root@controlplane ~ ➜ echo $HOME /root ``` The default kubeconfig file is normally `~/.kube/config` (here: `/root/.kube/config`). ```bash theme={null} root@controlplane ~ ➜ ls -la $HOME/.kube total 12 drwxr-xr-x 2 root root 4096 Apr 1 00:00 . drwxr-xr-x 3 root root 4096 Apr 1 00:00 .. -rw------- 1 root root 1200 Apr 1 00:00 config root@controlplane ~ ➜ cat $HOME/.kube/config apiVersion: v1 clusters: - cluster: certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJ... server: https://controlplane:6443 name: kubernetes contexts: - context: cluster: kubernetes user: kubernetes-admin name: kubernetes-admin@kubernetes current-context: kubernetes-admin@kubernetes kind: Config preferences: {} users: - name: kubernetes-admin user: client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJ... client-key-data: LS0tLS1CRUdJTiB... ``` Quick summary for this default kubeconfig: | Item | Value | | - | - | | Clusters defined | 1 (`kubernetes`) | | Users defined | 1 (`kubernetes-admin`) | | Contexts defined | 1 (`kubernetes-admin@kubernetes`) | | Current context user | `kubernetes-admin` | | Cluster name | `kubernetes` | ## Inspect an alternate kubeconfig: `/root/my-kube-config` A separate kubeconfig file exists at `/root/my-kube-config`. Review its contents: ```bash theme={null} root@controlplane ~ ➜ cat /root/my-kube-config apiVersion: v1 kind: Config clusters: - name: production cluster: certificate-authority: /etc/kubernetes/pki/ca.crt server: https://controlplane:6443 - name: development cluster: certificate-authority: /etc/kubernetes/pki/ca.crt server: https://controlplane:6443 - name: kubernetes-on-aws cluster: certificate-authority: /etc/kubernetes/pki/ca.crt server: https://controlplane:6443 - name: test-cluster-1 cluster: certificate-authority: /etc/kubernetes/pki/ca.crt server: https://controlplane:6443 contexts: - name: test-user@development context: cluster: development user: test-user - name: aws-user@kubernetes-on-aws context: cluster: kubernetes-on-aws user: aws-user - name: test-user@production context: cluster: production user: test-user - name: research context: cluster: test-cluster-1 user: dev-user users: - name: test-user user: client-certificate: /etc/kubernetes/pki/users/test-user/test-user.crt client-key: /etc/kubernetes/pki/users/test-user/test-user.key - name: dev-user user: client-certificate: /etc/kubernetes/pki/users/dev-user/developer-user.crt client-key: /etc/kubernetes/pki/users/dev-user/dev-user.key - name: aws-user user: client-certificate: /etc/kubernetes/pki/users/aws-user/aws-user.crt client-key: /etc/kubernetes/pki/users/aws-user/aws-user.key current-context: test-user@development preferences: {} ``` Summary for `/root/my-kube-config`: | Item | Value | | - | - | | Clusters defined | 4 (`production`, `development`, `kubernetes-on-aws`, `test-cluster-1`) | | Contexts defined | 4 (`test-user@development`, `aws-user@kubernetes-on-aws`, `test-user@production`, `research`) | | User for `research` context | `dev-user` | | `aws-user` client certificate file | `/etc/kubernetes/pki/users/aws-user/aws-user.crt` | | Current context in file | `test-user@development` | ## Switch context to use `dev-user` on `test-cluster-1` The `research` context maps `dev-user` to `test-cluster-1`. To use that context from the alternate kubeconfig, tell `kubectl` which kubeconfig to operate on using `--kubeconfig` (the default `kubectl config` operations target `~/.kube/config` unless you specify otherwise). Switch the context in `/root/my-kube-config`: ```bash theme={null} root@controlplane ~ ➜ kubectl config use-context research --kubeconfig /root/my-kube-config Switched to context "research". ``` Confirm the active context inside that kubeconfig: ```bash theme={null} root@controlplane ~ ➜ kubectl --kubeconfig /root/my-kube-config config view --minify current-context: research ``` ## Make `/root/my-kube-config` the default kubeconfig To avoid repeatedly specifying `--kubeconfig`, move `/root/my-kube-config` to the default location `~/.kube/config`: ```bash theme={null} root@controlplane ~ ➜ mkdir -p ~/.kube root@controlplane ~ ➜ mv /root/my-kube-config ~/.kube/config root@controlplane ~ ➜ kubectl config view apiVersion: v1 clusters: - cluster: certificate-authority: /etc/kubernetes/pki/ca.crt server: https://controlplane:6443 name: production - cluster: certificate-authority: /etc/kubernetes/pki/ca.crt server: https://controlplane:6443 name: development - cluster: certificate-authority: /etc/kubernetes/pki/ca.crt server: https://controlplane:6443 name: kubernetes-on-aws - cluster: certificate-authority: /etc/kubernetes/pki/ca.crt server: https://controlplane:6443 name: test-cluster-1 contexts: - context: cluster: kubernetes-on-aws user: aws-user name: aws-user@kubernetes-on-aws - context: cluster: test-cluster-1 user: dev-user name: research - context: cluster: development user: test-user name: test-user@development - context: cluster: production user: test-user name: test-user@production current-context: research kind: Config preferences: {} users: - name: aws-user user: client-certificate: /etc/kubernetes/pki/users/aws-user/aws-user.crt client-key: /etc/kubernetes/pki/users/aws-user/aws-user.key - name: dev-user user: client-certificate: /etc/kubernetes/pki/users/dev-user/developer-user.crt client-key: /etc/kubernetes/pki/users/dev-user/dev-user.key - name: test-user user: client-certificate: /etc/kubernetes/pki/users/test-user/test-user.crt client-key: /etc/kubernetes/pki/users/test-user/test-user.key ``` Now `kubectl` will use this kubeconfig by default. ## Troubleshoot access to the cluster With the default kubeconfig set and `current-context` as `research` (mapping `dev-user` to `test-cluster-1`), attempting to list nodes returns an authentication error: ```bash theme={null} root@controlplane ~ ➜ kubectl get nodes Error from server (Unauthorized): Unauthorized # (or) error: You must be logged in to the server (the server has asked for the client to provide credentials) ``` This indicates a credentials issue. Inspect the `dev-user` credentials referenced by the active kubeconfig: ```bash theme={null} root@controlplane ~ ➜ kubectl config view --raw -o yaml | sed -n '/- name: dev-user/,$p' - name: dev-user user: client-certificate: /etc/kubernetes/pki/users/dev-user/developer-user.crt client-key: /etc/kubernetes/pki/users/dev-user/dev-user.key ``` Check the files actually present on disk for `dev-user`: ```bash theme={null} root@controlplane ~ ➜ ls -la /etc/kubernetes/pki/users/dev-user total 12 -rw-r--r-- 1 root root 1200 Apr 1 00:00 dev-user.crt -rw-r--r-- 1 root root 800 Apr 1 00:00 dev-user.csr -rw------- 1 root root 1675 Apr 1 00:00 dev-user.key ``` Problem identified: the kubeconfig references `/etc/kubernetes/pki/users/dev-user/developer-user.crt` (a filename typo: `developer-user.crt`), but the actual certificate file is `dev-user.crt`. This filename mismatch prevents TLS client authentication. ### Fix the certificate path in the kubeconfig Use `kubectl config set-credentials` to correct `dev-user` and point it to the actual certificate and key files: ```bash theme={null} root@controlplane ~ ➜ kubectl config set-credentials dev-user \ --client-certificate=/etc/kubernetes/pki/users/dev-user/dev-user.crt \ --client-key=/etc/kubernetes/pki/users/dev-user/dev-user.key # Output: # user "dev-user" set ``` Verify the updated kubeconfig (minified view to show the active context and user mapping): ```bash theme={null} root@controlplane ~ ➜ kubectl config view --minify current-context: research # (Verify that dev-user now references dev-user.crt) ``` Retry the `kubectl` command to validate access: ```bash theme={null} root@controlplane ~ ➜ kubectl get nodes NAME STATUS ROLES AGE VERSION controlplane Ready master 10d v1.x.x worker1 Ready 10d v1.x.x # (example successful output) ``` After correcting the certificate paths, `kubectl` authenticates successfully using the `dev-user` credentials in the `research` context. If you need to operate on a non-default kubeconfig, use the `--kubeconfig` flag. To make a kubeconfig the default for all `kubectl` commands, place it at `~/.kube/config`. ## Links and references * [kubectl documentation](https://kubernetes.io/docs/reference/kubectl/) * [Kubeconfig file structure](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) * [Authenticating to the API server](https://kubernetes.io/docs/reference/access-authn-authz/authentication/) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.