How do I validate a kubeconfig file?
Reviewed by Prabath Thalangama · Last updated
Check that it is valid YAML of kind Config, that every context names a cluster and user that exist, that current-context matches a context, and that embedded certificates are valid base64. This validator runs those checks in your browser and lists the clusters, users and contexts it found.
Most confusing kubectl errors from a kubeconfig are structural: a context that points at a user name that was renamed, a current-context left over from a deleted cluster, or a certificate pasted with a stray character. Those are what this validator finds.
It reads the file only. It does not contact the cluster, so it cannot tell you whether credentials are expired or the server is reachable; kubectl cluster-info does that.
How do I check my kubeconfig?
- Paste the file, usually ~/.kube/config. You can remove token and key values first; the structure is what matters.
- Read the issues list. Each issue names the cluster, user or context it applies to.
- Fix the file, or switch context with kubectl config use-context, and validate again.
How to read the results
- Clusters, users, contexts
- The names defined in each list. A context joins one cluster and one user, plus an optional namespace.
- Current context
- The context kubectl uses when you don't pass --context.
- Issues
- Wrong kind or apiVersion, missing lists, clusters without a server URL, invalid base64 in certificate-authority-data, client-certificate-data or client-key-data, contexts that reference unknown clusters or users, and a missing or unknown current-context.
Common kubeconfig errors
context was not found for specified context
current-context names a context that doesn't exist, often after merging or deleting configs. Set it with kubectl config use-context <name>.
x509: certificate signed by unknown authority
certificate-authority-data is missing or belongs to a different cluster. Copy it again from the cluster's admin kubeconfig or your cloud provider's CLI.
illegal base64 data in client-key-data
The value was wrapped or truncated when it was copied. It must be one unbroken base64 string.
Examples and command-line equivalents
Inspect and switch contexts
kubectl config get-contexts
kubectl config current-context
kubectl config use-context prodMerge two kubeconfig files
KUBECONFIG=~/.kube/config:~/new-config kubectl config view --flatten > merged-configFrequently asked questions
How do I merge two kubeconfig files?
List both in the KUBECONFIG variable and run kubectl config view --flatten to write a single file, then validate the result here before replacing your main config.
Is it safe to paste my kubeconfig here?
Parsing happens in your browser and nothing is uploaded. A kubeconfig can still contain cluster-admin credentials, so remove tokens and keys first if you don't need them checked.
Why does kubectl ignore my changes?
The KUBECONFIG environment variable may point to a different file, or list several files that are merged. Run kubectl config view --minify to see the configuration actually in use.