---
title: How to connect to a Kubernetes Kapsule cluster with kubectl
description: Learn how to connect to a Kubernetes cluster using kubectl. Follow steps to manage cluster resources, deploy applications, and view logs easily from your local computer.
tags: connection cluster kubectl
dates:
validation: 2025-10-14
posted: 2020-09-20
---
import Requirements from '@macros/iam/requirements.mdx'
Once your [cluster is created](/kubernetes/how-to/create-cluster/), you can install a `kubeconfig` file using Scaleway's command-line tool on your local machine to manage your Kubernetes cluster.
You can use this with `kubectl`, the Kubernetes command-line tool, allowing you to run commands against your Kubernetes cluster. This enables you to deploy applications, inspect and manage cluster resources, and view logs directly from your local machine.
- A [Scaleway account](https://console.scaleway.com) logged into the console.
- [Owner status](https://console.scaleway.com) or [IAM permissions](/iam/concepts/#permission) to perform actions in the intended Organization.
- Created a [Kubernetes Kapsule cluster](/kubernetes/how-to/create-cluster/).
- [kubectl](https://kubernetes.io/docs/tasks/tools/) installed locally.
- The [Scaleway CLI](/scaleway-cli/quickstart/) installed locally.
## Setting fine-grained permissions (IAM Policies) for Kubernetes access
If your Organization uses IAM to control access, ensure that you or your group/application has the following permission sets assigned at the Project scope:
- `KubernetesFullAccess` (or `KubernetesReadOnly`, depending on your needs):
Grants you the ability to manage (or list/read) Kubernetes clusters, nodes, and related actions in your Scaleway Project.
If you have not yet configured IAM on your account, you can generate a `kubeconfig` file with IAM and the required permission sets from the Scaleway console after creating a cluster.
For detailed information about the configuration of IAM policies for your Kubernetes clusters, refer to our dedicated documentation [Setting IAM permissions and implementing RBAC on a cluster](/kubernetes/reference-content/set-iam-permissions-and-implement-rbac/).
## Accessing the cluster
1. Click **Kubernetes** in the **Containers** section of the [Scaleway console](https://console.scaleway.com) side menu. The Kubernetes Kapsule overview displays.
2. From the drop-down menu, select the geographical region you want to manage.
3. Click the name of the cluster you want to access. The cluster overview page displays. This page provides information about your cluster.
4. In the **Getting Started** section of the page, click **2 Download kubeconfig**, then **Generate kubeconfig**.
5. Enter your existing Scaleway API key or click **Generate API key** to generate a new one.
6. (Optional) Enter API key specifics by selecting the API key bearer, and entering a description and expiration date for the key. Then click **Generate API key**.
7. The secret key of your API key displays. **Copy and store it** in a secure location. It will only be shown once.
8. Click **Download kubeconfig** and run the command shown to export the path to the configuration file on your local machine.
You can use the Scaleway CLI to automatically retrieve (and merge) your `kubeconfig` file, then interact with your Kubernetes cluster.
#### Install and configure the Scaleway CLI
If you have not set up the Scaleway CLI yet:
1. Follow our [installation guide](/scaleway-cli/quickstart) for platform-specific instructions using Homebrew, Chocolatey, or manual methods.
2. Run the following command and follow the prompts to set up your CLI with your Scaleway API keys:
```bash
scw init
```
You will need your [API Key](/iam/how-to/create-api-keys/) (access key and secret key).
#### Retrieve and install the kubeconfig using scw
1. Run the following command to install the `kubeconfig` file for your cluster:
```bash
scw k8s kubeconfig install
```
This command will:
- Download the `kubeconfig` for the specified cluster.
- Merge it into your existing `kubeconfig` file (default location: `~/.kube/config`).
2. Verify the installation:
```bash
kubectl get nodes
```
A list of nodes from your Kapsule cluster should appear.
Refer to our complete [Documentation for `scw k8s`](https://github.com/scaleway/scaleway-cli/blob/master/docs/commands/k8s.md) to learn more about all available commands to manage your Kubernetes cluster using `scw`.
## Revoking user access to the Kubernetes cluster
When a user loses access rights (e.g., departs from the Organization), the Kubernetes administrator must take steps to revoke their access to the cluster.
This is typically done by modifying IAM settings, such as adjusting policies or deleting the user’s credentials.
### Steps to revoke access
To revoke a user's access to the cluster, ensure that any API keys associated with the user are no longer granted permission. Here are the steps you can take:
#### Delete the API key
- Locate the API key associated with the user.
- Remove the key to immediately revoke access.
#### Modify IAM policies
- Adjust the IAM policy linked to the API key to limit or remove its permissions.
#### Reassign the user to a restricted group
- Transfer the principal (application or user) to a group with reduced permissions that does not allow cluster access.
#### Delete the principal
- Permanently remove the user or application from the IAM system to ensure no further access is possible.
### Revoking kubeconfig access
To permanently revoke `kubeconfig` access via IAM:
- **Delete the API Key**: This will ensure that the user's `kubeconfig` file becomes invalid immediately.
- **Delete the Principal**: Removing the user or application guarantees that no further access can be gained, even if residual configurations exist.
- Be cautious when modifying IAM policies to avoid unintended access issues for other users or services.
- Regularly audit IAM settings and API keys to ensure compliance with organizational security policies.