---
title: "Retrieve the kubeconfig for a Kubernetes Cluster"
method: GET
path: "/v2/kubernetes/clusters/{cluster_id}/kubeconfig"
tags: ["DigitalOcean-public.v2-new_Kubernetes"]
---

# Retrieve the kubeconfig for a Kubernetes Cluster

`GET /v2/kubernetes/clusters/{cluster_id}/kubeconfig`

This endpoint returns a kubeconfig file in YAML format. It can be used to
connect to and administer the cluster using the Kubernetes command line tool,
`kubectl`, or other programs supporting kubeconfig files (e.g., client libraries).

The resulting kubeconfig file uses token-based authentication for clusters
supporting it, and certificate-based authentication otherwise. For a list of
supported versions and more information, see "[How to Connect to a DigitalOcean
Kubernetes Cluster](https://docs.digitalocean.com/products/kubernetes/how-to/connect-to-cluster/)".

To retrieve a kubeconfig file for use with a Kubernetes cluster, send a GET
request to `/v2/kubernetes/clusters/$K8S_CLUSTER_ID/kubeconfig`.

Clusters supporting token-based authentication may define an expiration by
passing a duration in seconds as a query parameter to
`/v2/kubernetes/clusters/$K8S_CLUSTER_ID/kubeconfig?expiry_seconds=$DURATION_IN_SECONDS`.
If not set or 0, then the token will have a 7 day expiry. The query parameter
has no impact in certificate-based authentication.

Kubernetes Roles granted to a user with a token-based kubeconfig are derived from that user's
DigitalOcean role. Predefined roles (Owner, Member, Modifier etc.) have an automatic mapping
to Kubernetes roles. Custom roles are not automatically mapped to any Kubernetes roles,
and require [additional configuration](https://docs.digitalocean.com/products/kubernetes/how-to/set-up-custom-rolebindings/)
by a cluster administrator.

## Path parameters

- `cluster_id` string, uuid, required

## Query parameters

- `expiry_seconds` integer

## Response `200`

A kubeconfig file for the cluster in YAML format.

## Other responses

- `401` — Authentication failed due to invalid credentials.
- `404` — The resource was not found.
- `429` — The API rate limit has been exceeded.
- `500` — There was a server error.
- `default` — There was an unexpected error.

---

[API](https://skmtc.net/digitalocean/apis/digitalocean-api.md) · [All operations](https://skmtc.net/digitalocean/apis/digitalocean-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/digitalocean/digitalocean-api/revisions/cb3bf9b21459/schema)