kubectl configManage clusters, users and contexts in kubeconfig
kubectl config reads and edits your kubeconfig: the file that tells kubectl which clusters exist, how to authenticate to each, and which one (and which namespace) your commands go to right now. Switching context is how you move between dev and prod, so it's also how prod accidents happen.
kubectl config (get-contexts | current-context | use-context NAME | set-context [--current] --namespace=NS | view [--minify] | rename-context | delete-context) Before a change, confirm which cluster and namespace kubectl will hit, then switch to the dev cluster.
kubectlThe Kubernetes CLI.
A kubeconfig is a YAML file with three lists, clusters (API server URL and CA certificate), users (credentials: a client certificate, a token, or an exec plugin), and contexts that pair a cluster with a user and optional namespace, plus current-context. kubectl loads it from --kubeconfig, else from the KUBECONFIG variable (a colon-separated list of files merged in order; the first to set a value wins), else ~/.kube/config. kubectl config subcommands just read and rewrite those files; they never contact a cluster. On EKS, aws eks update-kubeconfig adds a cluster entry and a user that uses the exec plugin: each kubectl call runs aws eks get-token, which creates a presigned STS GetCallerIdentity request; the EKS API server verifies it and maps your IAM identity to Kubernetes users and groups through access entries (or the older aws-auth ConfigMap). Tokens last about 15 minutes and are refreshed automatically.
get-contextsList contexts; * marks the current onecurrent-contextPrint the active context's nameuse-context NAMESwitch the active contextset-context --current --namespace=NSChange the default namespaceview [--minify] [--raw]Show the merged config; --minify = current context onlyrename-context OLD NEWGive a context a friendlier namedelete-context NAMERemove a context (the cluster and user entries stay)get-clusters / get-usersList cluster and user entries--kubeconfig FILEUse a specific file for this one commandRunning kubectl delete or apply without checking the current contextuse-context in one terminal changes ~/.kube/config for every terminal; the command may hit prod.
kubectl config current-context first, or put the context in your prompt; use --context explicitly in scriptsCommitting ~/.kube/config or pasting kubectl config view --raw into a ticketIt can contain client certificates and tokens that grant cluster access.
Share the cluster name and region; others run aws eks update-kubeconfig themselvesUsing a long-lived ServiceAccount token in CI kubeconfigsIt never expires and is hard to rotate; a leak means permanent access.
Use OIDC/IAM-based short-lived credentials (EKS access entries, IRSA for CI runners)Try these on a Linux machine of your own. Each task has a hint and a solution.
Write the commands to switch to the context named prod and make monitoring its default namespace.
Write a one-off command that lists pods in the context dev without switching your current context.
Switch to the dev context, list its pods (its default namespace is payments), then switch back to prod and check which context is active.
In AWS Lab > EKS > your cluster > Run kubectl (lab), open your cluster's Overview and find the command that connects kubectl (update-kubeconfig) and the API server endpoint it would write.
kubectl configManage clusters, users and contexts in kubeconfig
kubectl config reads and edits your kubeconfig: the file that tells kubectl which clusters exist, how to authenticate to each, and which one (and which namespace) your commands go to right now. Switching context is how you move between dev and prod, so it's also how prod accidents happen.
kubectl config (get-contexts | current-context | use-context NAME | set-context [--current] --namespace=NS | view [--minify] | rename-context | delete-context) Before a change, confirm which cluster and namespace kubectl will hit, then switch to the dev cluster.
kubectlThe Kubernetes CLI.
A kubeconfig is a YAML file with three lists, clusters (API server URL and CA certificate), users (credentials: a client certificate, a token, or an exec plugin), and contexts that pair a cluster with a user and optional namespace, plus current-context. kubectl loads it from --kubeconfig, else from the KUBECONFIG variable (a colon-separated list of files merged in order; the first to set a value wins), else ~/.kube/config. kubectl config subcommands just read and rewrite those files; they never contact a cluster. On EKS, aws eks update-kubeconfig adds a cluster entry and a user that uses the exec plugin: each kubectl call runs aws eks get-token, which creates a presigned STS GetCallerIdentity request; the EKS API server verifies it and maps your IAM identity to Kubernetes users and groups through access entries (or the older aws-auth ConfigMap). Tokens last about 15 minutes and are refreshed automatically.
get-contextsList contexts; * marks the current onecurrent-contextPrint the active context's nameuse-context NAMESwitch the active contextset-context --current --namespace=NSChange the default namespaceview [--minify] [--raw]Show the merged config; --minify = current context onlyrename-context OLD NEWGive a context a friendlier namedelete-context NAMERemove a context (the cluster and user entries stay)get-clusters / get-usersList cluster and user entries--kubeconfig FILEUse a specific file for this one commandRunning kubectl delete or apply without checking the current contextuse-context in one terminal changes ~/.kube/config for every terminal; the command may hit prod.
kubectl config current-context first, or put the context in your prompt; use --context explicitly in scriptsCommitting ~/.kube/config or pasting kubectl config view --raw into a ticketIt can contain client certificates and tokens that grant cluster access.
Share the cluster name and region; others run aws eks update-kubeconfig themselvesUsing a long-lived ServiceAccount token in CI kubeconfigsIt never expires and is hard to rotate; a leak means permanent access.
Use OIDC/IAM-based short-lived credentials (EKS access entries, IRSA for CI runners)Try these on a Linux machine of your own. Each task has a hint and a solution.
Write the commands to switch to the context named prod and make monitoring its default namespace.
Write a one-off command that lists pods in the context dev without switching your current context.
Switch to the dev context, list its pods (its default namespace is payments), then switch back to prod and check which context is active.
In AWS Lab > EKS > your cluster > Run kubectl (lab), open your cluster's Overview and find the command that connects kubectl (update-kubeconfig) and the API server endpoint it would write.