Connect to the Kubernetes cluster

Three tools, one sign-in command, one file to drop in place. After that, kubectl talks to the cluster with your Qim info account, and there’s nothing to redo until the token expires.

The three tools

kubectl to talk to the cluster, Azure CLI to authenticate, kubelogin to turn your Azure CLI session into a token the API server understands.

brew install kubernetes-cli azure-cli
brew install Azure/kubelogin/kubelogin

winget install -e --id Kubernetes.kubectl
winget install -e --id Microsoft.AzureCLI
# kubelogin, shipped with the AKS tools
az aks install-cli

With Azure CLI installed, az aks install-cli downloads kubectl and kubelogin and puts them in your PATH. The command name mentions AKS, but the tool it fetches is the same for any cluster authenticated through Entra ID.

az aks install-cli

Signing in

Sign in to the labs tenant, requesting a token for the cluster. Both options matter: without --scope, Azure CLI issues a token for itself, which the API server will reject.
Terminal window
```
az login \
  --tenant 14d30a29-fece-4f5b-a459-2b436eacd496 \
  --scope 14a43433-2800-455b-b11b-744de5e6e18a/.default
```

Put the cluster’s kubeconfig in a file of its own, and point KUBECONFIG at it. The content is just below.

mkdir -p ~/.kube
# Paste the content of the next section into this file
"${EDITOR:-nano}" ~/.kube/qiminfo-lab.yaml

export KUBECONFIG="$HOME/.kube/qiminfo-lab.yaml"

Check that access works. The first command triggers the token exchange through kubelogin, without opening a browser since your Azure CLI session is already open.
Terminal window
```
kubectl config use-context kube-lab
kubectl version --output=yaml     # the serverVersion section proves the cluster is responding
kubectl get namespaces
```
Work in a namespace of your own, and make it the current namespace. Pick a recognizable name, your trigram followed by the topic, so nobody has to ask who owns what’s running.
Terminal window
```
kubectl create namespace qro-demo
kubectl config set-context --current --namespace=qro-demo
```

You’re ready to deploy: deploy and expose an application.

The kubeconfig

Paste as is into ~/.kube/qiminfo-lab.yaml. The certificate-authority-data value is one single long line: a copy that splits it in two makes TLS verification fail.

apiVersion: v1
clusters:
  - cluster:
      certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPUFFRREFqQWpNU0V3SHdZRFZRUUREQmhyTTNNdGMyVnkKZG1WeUxXTmhRREUzT0RNMk1EWTJOVEl3SGhjTk1qWXdOekE1TVRNeE56TXlXaGNOTXpZd056QTJNVE14TnpNeQpXakFqTVNFd0h3WURWUVFEREJock0zTXRjMlZ5ZG1WeUxXTmhRREUzT0RNMk1EWTJOVEl3V1RBVEJnY3Foa2pPClBRSUJCZ2dxaGtqT1BRTUJCd05DQUFTVUNXZ2JZVi9oZE84TUl2WTVrSlMrdC9KYi9OMU5LQSthWC8vMktLNGwKVE51RmFWbnAyQ0dmM0JQb2dNRDFkb0lsUlVmNHY1SXF4UHg3VG5TL1k2K1RvMEl3UURBT0JnTlZIUThCQWY4RQpCQU1DQXFRd0R3WURWUjBUQVFIL0JBVXdBd0VCL3pBZEJnTlZIUTRFRmdRVUJxYkNPUlhXN3kzNFJZWVNOUmpMCjZDb3V1Ukl3Q2dZSUtvWkl6ajBFQXdJRFNRQXdSZ0loQUp1UXdzNGk1TnFlMzYvRTQ4bEwzT1U1Q3kySDZtblYKYktPaDJXWEdpTlorQWlFQW1aMjhHRXBPOCsxUW1NdkhCRG5IdEE1a0V5WndpV3o2dDhFUW5Yam5jRk09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K
      server: https://k8s.qiminfo-lab.ch:6443
    name: kube-lab
contexts:
  - context:
      cluster: kube-lab
      namespace: default
      user: kube-lab
    name: kube-lab
current-context: kube-lab
kind: Config
preferences: {}
users:
  - name: kube-lab
    user:
      exec:
        apiVersion: client.authentication.k8s.io/v1beta1
        command: kubelogin
        args:
          - get-token
          - --login
          - azurecli
          - --server-id
          - 14a43433-2800-455b-b11b-744de5e6e18a
        env: null
        interactiveMode: IfAvailable
        provideClusterInfo: false
        installHint: |
          kubelogin is not installed which is required to connect to AAD enabled cluster.

          To learn more, please go to https://aka.ms/aks/kubelogin

Already have clusters in ~/.kube/config? kubectl can merge them: export KUBECONFIG="$HOME/.kube/config:$HOME/.kube/qiminfo-lab.yaml", then kubectl config use-context kube-lab to switch. Put the variable in your shell profile, otherwise it disappears when you close the terminal.

What gets stuck on the first connection

The symptom	What’s going on
`kubelogin is not installed…`	The kubeconfig calls a tool that isn’t in your `PATH`. Go back to the installation; `az aks install-cli` is enough.
`You must be logged in to the server (Unauthorized)`	The token was issued for the wrong audience. Rerun `az login` with the `--scope` option from step 1.
A tenant-not-found or unknown-account message	Your Azure CLI session is open on another tenant. The `--tenant` option in step 1 isn’t optional.
`x509: certificate signed by unknown authority`	The `certificate-authority-data` value was truncated or split across several lines when pasting.
`Error from server (Forbidden)`	Authentication succeeded; it’s authorization that refuses. Stay in your namespace. If the need is real, write to lab@qiminfo.ch.
`kubectl` responds, but for another cluster	Several merged kubeconfigs and the wrong current context: `kubectl config use-context kube-lab`.
A timeout, or “connection refused”	The network blocks the API server’s port 6443. Common behind a VPN or at a client that only allows web traffic: `nc -vz k8s.qiminfo-lab.ch 6443` confirms it in a second. Port 443 on the same domain serves applications, not `kubectl`.