Kubeconfig and kubectl access¶

A kubeconfig is the credential file kubectl uses to call your cluster. Treat a downloaded file as a secret. Access inside the cluster (Roles, RoleBindings, service accounts) is yours to configure.

Who can do this: a member or a super_admin. Some organizations limit download to super_admin. If the button is missing, ask your account team.

Access is available from Control plane ready onward, and once the cluster is Ready.

A static kubeconfig is a secret

The downloaded file carries cluster-admin credentials. Anyone who holds it can administer the cluster. Never commit it, never paste it into tickets or chat, and prefer the door CLI for day-to-day access. Downloading again does not revoke an older copy.

Connecting from the console¶

Access and kubeconfig: door CLI, private or public API, static kubeconfig

Access tab in the demo organization (cluster cp-canary-in). Cluster Access is Private, so the card shows the VPN / Direct Connect endpoint; the static kubeconfig card reads Managed by your organization policy. Your cluster shows its own API address.

Open the cluster and the Access & kubeconfig tab.
Recommended: door CLI (badge Auto-rotating). Install the CLI if you need it, then run the commands on the card. The card's doorctl login line includes a token for your organization; the block below uses placeholders:
```
doorctl config --server-url https://api.apps.gocno.io --organization acme
doorctl login
doorctl kubectl config --cluster <cluster-id>
kubectl get nodes
```
Install notes: Install the door CLI.
Cluster Access shows Private or Public. Private shows API endpoint (VPN / Direct Connect) (https://<address>:6443). Public shows an HTTPS hostname under clusters.dks.door.africa with no port. See API server exposure.
Static kubeconfig (for CI) downloads a file for automation. If your organization has turned that off, the card reads Managed by your organization policy. Use the CLI instead. Store the file with chmod 600.

If you switch Private / Public, download the file again. The server address inside it changes.

There is no separate action to rotate a static file. Download a new one, and stop using the old copy.

Connecting with Maya¶

You can ask Maya for the kubeconfig once the cluster is Control plane ready or Ready. Prefer the Access & kubeconfig tab so the file does not land in the chat transcript. Reading the kubeconfig is not a change, so there is no approval step.

Next

The download call for scripts is in the API reference.