CLI Access

You can access clusters from CLI using one of two kubeconfig options from the cluster’s CLI Access dialog in the console.

Option 1: OIDC kubeconfig (recommended for humans)

• Best for interactive kubectl use.
• Requires kubelogin installed locally.
• OIDC session currently lasts 24 hours.

Quick steps

1. Install kubelogin.
2. Download the OIDC kubeconfig from the console.
3. Run:

kubectl --kubeconfig ./<cluster>-oidc.kubeconfig get ns

Option 2: Token kubeconfig (recommended for automation)

• Best for CI jobs, scripts, and non-interactive tasks.
• You can choose token expiry at generation time.
• Supported expiry options go up to 365 days.

Available durations:

• 8 hours
• 24 hours
• 7 days
• 30 days
• 90 days
• 365 days

Quick steps

1. Download a token kubeconfig from the console and choose expiry.
2. Use it in automation:

kubectl --kubeconfig ./<cluster>-token.kubeconfig get pods -A

Which one should I use?

• Use OIDC kubeconfig for engineers working from terminal.
• Use token kubeconfig for automation where browser sign-in is not possible.

Security guidance

• Prefer shortest practical token lifetime for automation.
• Rotate long-lived tokens regularly.
• Store kubeconfigs in secret managers, not source control.