LAB02d: Setting up Kubeconfig

How kubeconfig works

How to create new users

How to create new contexts

How to switch between users/contexts

How to merge multiple kubeconfig files

How to view certificates/server details

How to test RBAC access using kubeconfig

LAB: Mastering Kubeconfig (100% Commands, No YAML)

1. Identify your current kubeconfig location

echo $KUBECONFIG

If empty, default is:

ls ~/.kube/config

View:

kubectl config view

2. Copy kubeconfig to a fresh lab file (safe practice)

cp ~/.kube/config ~/kubeconfig-lab
export KUBECONFIG=~/kubeconfig-lab

Verify using:

kubectl config view --minify

3. Create a new user from commands (password or token method)

Option A — Basic username+password user

(no certs needed)

kubectl config set-credentials ram \
  --username=ram \
  --password=ram123

Option B — Token-based user (common in OIDC)

kubectl config set-credentials ram \
  --token=eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...

Option C — Client certificate (recommended in kubeadm labs)

kubectl config set-credentials ram \
  --client-certificate=ram.crt \
  --client-key=ram.key

4. Create a new context for user ram

kubectl config set-context ram-context \
  --cluster=kubernetes \
  --user=ram \
  --namespace=vpsxyz

List contexts:

kubectl config get-contexts

5. Switch to new context (this changes your “identity”)

kubectl config use-context ram-context

Confirm:

kubectl config current-context
kubectl auth whoami

6. Test access using new user

Try getting pods:

kubectl get pods

If you did not create RBAC earlier, you should get:

Error from server (Forbidden)

Check who Kubernetes thinks you are:

kubectl auth whoami

7. Add namespace to context (modify existing context)

kubectl config set-context ram-context --namespace=vpsxyz

Verify:

kubectl config view --minify

8. Create another kubeconfig and MERGE

Create a second kubeconfig:

kubectl config view --raw > /tmp/second-kubeconfig

Merge both kubeconfigs:

KUBECONFIG=~/kubeconfig-lab:/tmp/second-kubeconfig kubectl config view --merge --flatten > ~/merged.yaml

Test merged file:

KUBECONFIG=~/merged.yaml kubectl get nodes

9. Rename a context (command only)

kubectl config rename-context ram-context dev-ram

---

10. Remove (delete) a user, cluster, or context

Delete user:

kubectl config unset users.ram

Delete context:

kubectl config delete-context dev-ram

Delete cluster entry:

kubectl config unset clusters.kubernetes

11. Show certificate + cluster server details

Check API server endpoint:

kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}'

Check CA:

kubectl config view --raw -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' | base64 -d | openssl x509 -noout -text

Check user's certificate:

kubectl config view --raw -o jsonpath='{.users[0].user.client-certificate-data}' | base64 -d | openssl x509 -noout -text

12. Create a kubeconfig for a single user only

This is common for distributing access to team members:

kubectl config --kubeconfig=ram-only.yaml set-credentials ram \
  --client-certificate=ram.crt \
  --client-key=ram.key

kubectl config --kubeconfig=ram-only.yaml set-context ram-context \
  --cluster=kubernetes \
  --user=ram

kubectl config --kubeconfig=ram-only.yaml use-context ram-context

Test:

KUBECONFIG=ram-only.yaml kubectl get pods