Skip to main content

Export Kube-Config

Customize how vCluster exports the kubeconfig file to a secret, so you can use it, for example, in your ArgoCD or Terraform pipelines.

vCluster always creates a kubeconfig in a secret called vc-NAME in the namespace where you deployed vCluster. Configure exportKubeConfig so vCluster creates an additional secret with the given configuration.

Example using the same namespace for the secret​

In this example:

  • You want to call this kubeconfig context my-domain-context.
  • You have exposed the virtual cluster on https://my-domain.org and want the kubeconfig to use that endpoint.
  • You named your cluster "my-cluster" but you want the secret's name to reflect the virtual cluster domain name.
exportKubeConfig:
  context: my-domain-context
  server: https://my-domain.org
  secret:
    name: vc-my-domain

Example using a new namespace for the secret​

In this example:

  • You want to call this kubeconfig context my-domain-context.
  • You have exposed the virtual cluster on https://my-domain.org and want the kubeconfig to use that endpoint.
  • You created a namespace called kubeconfig-secret-namespace for the secret.
  • You named your cluster "my-cluster" but you want the secret's name to reflect the virtual cluster domain name.
  • You have acccess to the new namespace by creating a role and rolebinding pointing to the vCluster service account. Make sure that the new role has the same permissions as the vCluster app's role in the vCluster app's namespace. You can copy them directly from the ones created by vCluster when you deployed vCluster. vCluster permissions are dynamic, so updating some configurations may require you to update the unmanaged role in the target namespace.
exportKubeConfig:
  context: my-domain-context
  server: https://my-domain.org
  secret:
    namespace: kubeconfig-secret-namespace
    name: vc-my-domain

Config reference​

exportKubeConfig required object pro​

ExportKubeConfig describes how vCluster should export the vCluster kubeConfig file.

context required string pro​

Context is the name of the context within the generated kubeconfig to use.

server required string pro​

Override the default https://localhost:8443 and specify a custom hostname for the generated kubeconfig.

insecure required boolean false pro​

If tls should get skipped for the server

serviceAccount required object pro​

ServiceAccount can be used to generate a service account token instead of the default certificates.

name required string pro​

Name of the service account to be used to generate a service account token instead of the default certificates.

namespace required string pro​

Namespace of the service account to be used to generate a service account token instead of the default certificates. If omitted, will use the kube-system namespace.

clusterRole required string pro​

ClusterRole to assign to the service account.

secret required object pro​

Declare in which host cluster secret vCluster should store the generated virtual cluster kubeconfig. If this is not defined, vCluster will create it with vc-NAME. If you specify another name, vCluster creates the config in this other secret.

name required string pro​

Name is the name of the secret where the kubeconfig should get stored.

namespace required string pro​

Namespace where vCluster should store the kubeconfig secret. If this is not equal to the namespace where you deployed vCluster, you need to make sure vCluster has access to this other namespace.