Connecting to your cluster

Access to your cluster is self-service through the Customer Portal. Once your cluster is provisioned and your federated identity has been granted access, you issue your own kubeconfig from the portal; there is no credential file to wait for, and no shared team credential to pass around.

Getting access

The users named in your order are granted access when the cluster is provisioned. After that, your customer admin manages access directly in the portal: adding a user takes effect immediately, and removing one also revokes every kubeconfig they hold on the cluster.

Sign in to the portal with your federated identity (SWAMID), open your cluster, and issue a kubeconfig under My credentials. Each credential is personal: it is issued to your identity, labeled so you can tell your credentials apart (for example laptop and ci), and can be rotated or revoked independently. The kubeconfig is shown exactly once at issue time, so download it right away.

See Tenant Kubernetes clusters for the full portal workflow: issuing, rotating, and revoking credentials, and managing cluster users.

First connection

Point kubectl at the downloaded kubeconfig and confirm access:

export KUBECONFIG=/path/to/your-cluster.kubeconfig
kubectl config get-contexts
kubectl get applications -n argocd

What your account can do

Your credential is scoped via RBAC to the argocd namespace, where you manage applications and resources through ArgoCD. Other namespaces and cluster-wide resources remain isolated for security.

This means you do not create workloads directly with kubectl apply into arbitrary namespaces. Instead you commit manifests to your Git repository and let ArgoCD deploy them, including into other namespaces. See GitOps with ArgoCD for how that works.