Kubeconfig

A kubeconfig file contains the cluster API server address, authentication credentials, and cluster-specific settings needed to interact with a Kubernetes cluster. You can use Palette's kubeconfig files to issue kubectl commands against your self-hosted management and workload clusters.

info

This guide focuses on the kubeconfig files for workload clusters. The kubeconfig for self-hosted management clusters is found at the system console at Enterprise Cluster > Overview tab. Refer to the appropriate self-hosted Palette or Palette VerteX guide for details on accessing the system console.

Types of Kubeconfig Files

Palette provides up to two kubeconfig files for each workload cluster, depending on your cluster configuration and Palette permissions. These files are located at Clusters > Overview tab. Refer to our Kubectl guide for steps on how to download the kubeconfig file and connect to your cluster with the kubectl CLI.

• Kubeconfig - Authenticates you through OpenID Connect (OIDC) as a specific user. The cluster identifies you by your username and group memberships, allowing Kubernetes Role-Based Access Control (RBAC) policies to control what you can access. This file only appears on the cluster Overview tab when OIDC is configured in the Kubernetes layer of your cluster profile. Using this file requires the kubelogin plugin on the machine where you run kubectl. Refer to the respective Kubernetes distribution on the Packs List page to learn more about OIDC configuration.

• Admin Kubeconfig - Authenticates with a shared cluster administrator certificate and grants full Cluster Admin privileges. This file is intended for automation, emergency scenarios, or environments where OIDC is not available. It is always available to users with sufficient Palette permissions, regardless of whether OIDC is configured.

info

The Spectro Proxy pack affects how Palette routes connections to the cluster API server but does not determine whether the kubeconfig or admin kubeconfig file is available. Kubeconfig availability depends on OIDC configuration and your Palette permissions.

Permission Requirements

Palette has its own RBAC system that is separate from the Kubernetes RBAC system in the cluster. Palette permissions control platform-level operations within Palette, such as downloading kubeconfig files, whereas Kubernetes RBAC permissions control what you can do inside the cluster, such as creating pods. Refer to Palette Roles and Kubernetes Roles for additional information.

Access to each kubeconfig file depends on Palette permissions. For more information on specific permissions, refer to the Project Roles page.

• Kubeconfig - Requires at least the Cluster Viewer role or a custom role with the cluster.get permission.

  warning

  When enabling OIDC, ensure the oidc-issuer-url parameter and the clientConfig block are both properly configured in the Kubernetes pack YAML. Both parameters are required for the kubeconfig file to be available to all project users. If either is missing, the kubeconfig file is only available to users with the Cluster Admin role or a custom role that has the cluster.adminKubeconfigDownload permission.

• Admin Kubeconfig - Requires the Cluster Admin role or a custom role with the cluster.adminKubeconfigDownload permission.

Kubeconfig Access

Use the following table to identify which kubeconfig files are available based on your Palette permissions and cluster configuration.

Palette Role	Cluster OIDC Configured	Kubeconfig Access	Admin Kubeconfig Access
Cluster Admin	✅	✅	✅
Cluster Admin	❌	❌	✅
Non-Cluster Admin	✅	✅	❌
Non-Cluster Admin	❌	❌	❌

API Access

Palette exposes two API endpoints for downloading kubeconfig files, which returns the files as text strings. Access is determined by your Palette permissions. Refer to the Palette API documentation for more information.

• Kubeconfig - https://api.spectrocloud.com/v1/spectroclusters/{clusterId}/assets/kubeconfig

• Admin Kubeconfig - https://api.spectrocloud.com/v1/spectroclusters/{clusterId}/assets/adminkubeconfig