LAB04c: Setting up Cluster Connection

LAB 19: Setting up cluster connect

How to Create a New Kubernetes Context

1. Check what you already have

kubectl config get-contexts
kubectl config view

---

2. Create a new context

Use the kubectl config set-context command:

kubectl config set-context <context-name> \
    --cluster=<cluster-name> \
    --user=<user-name> \
    --namespace=<namespace-name>

Example:

kubectl config set-context prod-admin \
    --cluster=prod-cluster \
    --user=admin-user \
    --namespace=prod

This welds the triplet together:

• cluster → prod-cluster

• user → admin-user

• namespace → prod

---

3. Switch to your new context

kubectl config use-context prod-admin

kubectl will now speak to that cluster using that user and namespace.

---

Manually Creating a Context

STEP 1 — Get the Required Files From the Remote Server

To connect to a remote cluster, kubectl requires three pieces of information:

✔️ 1. API Server endpoint

https://<control-plane-ip>:6443

✔️ 2. CA certificate (ca.crt)

To trust the server.

✔️ 3. Client credentials (cert/key OR token)

Choose ONE of these:

• client-certificate.crt + client-key.key (secure, best)

• bearer token (service accounts)

• OIDC token (enterprise setups)

• kubeadm admin.conf (easiest)

---

Copy admin.conf (easiest and most common)

On the Kubernetes master/control-plane node:

sudo cat /etc/kubernetes/admin.conf

Copy it to your local machine as:

~/.kube/config

Or download it:

scp user@<master-ip>:/etc/kubernetes/admin.conf ~/.kube/config

Done. You’re instantly connected.

---

If You Want to Build kubeconfig Manually

If you don’t want to use admin.conf, follow this Lego route.

---

STEP 2 — Add the Cluster Info

kubectl config set-cluster my-remote \
  --server=https://<master-ip>:6443 \
  --certificate-authority=/path/ca.crt \
  --embed-certs=true

---

STEP 3 — Add User Credentials

Option A — With client certificate/key

kubectl config set-credentials remote-admin \
  --client-certificate=/path/client.crt \
  --client-key=/path/client.key \
  --embed-certs=true

Option B — With bearer token

kubectl config set-credentials remote-admin \
  --token=<SERVICE-ACCOUNT-TOKEN>

---

STEP 4 — Create the Context

kubectl config set-context remote-context \
  --cluster=my-remote \
  --user=remote-admin \
  --namespace=default

STEP 5 — Use the Context

kubectl config use-context remote-context

Test the Connection

kubectl get nodes

If you see the nodes → you’re in.

If you get:

Unable to connect to the server: x509 certificate...

→ your CA is wrong or missing.

If you get:

Unauthorized

→ credentials mismatch (user cert/token issue).

---

How to handle multiple config file

Here are the three safe strategies to add a new kubeconfig without harming your existing one.

---

Option 1 — Safest: Merge Using KUBECONFIG Variable (Non-Destructive)

Keep your original kubeconfig safe and load the new config side-by-side.

Step 1: Save your new config as a separate file

Example:

~/.kube/config-original      (existing)
~/.kube/config-remote        (new)

Step 2: Temporarily merge them

export KUBECONFIG=~/.kube/config-original:~/.kube/config-remote
kubectl config view --merge --flatten > ~/.kube/config-merged

Step 3: Replace the main config with the merged one

mv ~/.kube/config ~/.kube/config.backup
mv ~/.kube/config-merged ~/.kube/config

Your old config stays intact (backup) Your new config is merged safely kubectl sees both clusters

---

Option 2 — Use Multiple Kubeconfigs Without Merging

You can keep multiple kubeconfig files and switch between them.

Use original config:

export KUBECONFIG=~/.kube/config

Use remote cluster:

export KUBECONFIG=~/.kube/config-remote

Make it permanent per-shell:

Add to your .bashrc or .zshrc:

export KUBECONFIG="$HOME/.kube/config:$HOME/.kube/config-remote"

Now kubectl sees both configs.

---

Option 3 — Create Named Contexts Inside One File (Recommended)

If your new config contains:

• cluster

• user

• context

…you can import them into your main config.

Add cluster:

kubectl config set-cluster remote \
  --server=https://<remote-ip>:6443 \
  --certificate-authority=/path/ca.crt \
  --embed-certs=true

Add credentials:

kubectl config set-credentials remote-admin \
  --client-certificate=/path/client.crt \
  --client-key=/path/client.key \
  --embed-certs=true

Add context:

kubectl config set-context remote-context \
  --cluster=remote \
  --user=remote-admin

Switch:

kubectl config use-context remote-context

Your old context stays untouched, your new one joins the family.

---

Which option should you use?

Situation	Best Option
You want to avoid ANY risk to your current kubeconfig	Option 1 (manual merge)
You manage many clusters and prefer isolation	Option 2 (multiple files)
You want one convenient kubeconfig	Option 3 (named contexts)