Skip to content
DCS

PRACTICAL GUIDE

Connect to a private Kubernetes cluster

You need two things to reach a private cluster: a network path from your computer and credentials accepted by Kubernetes. A kubeconfig supplies connection settings and credentials, not the network path.

Before you start

This guide assumes an enabled environment, an active cluster and an account with permission to connect. New beta deployments are currently paused. Install the Tailscale client and kubectl on your computer before following the console’s connection instructions.

If you already use another Tailscale network, joining the DCS private network switches your active connection. Choose a suitable computer and account for this work. Do not paste device keys or kubeconfigs into support messages.

Enrol this computer

  1. Sign in, select your organisation, find the cluster and open Connect.
  2. Select the terminal instructions for your operating system, then choose Download device key.
  3. Run the connection command shown in the dialog from the folder containing the key. Use the actual login-server address and filename shown for your cluster.
  4. Use the key before its displayed deadline and delete the downloaded key file after successful connection. If enrollment expires, issue a new key rather than reusing the old one.

Download credentials and check the nodes

Choose Download kubeconfig in Connect and store the file privately. The credential grants administrator access to that cluster. Replace the sample filename below with your downloaded filename.

A successful node listing confirms access to the API. Check the node status before deploying an application; an accessible API does not imply that every workload is healthy.

kubectl --kubeconfig ./my-cluster-kubeconfig.yaml get nodes
kubectl --kubeconfig ./my-cluster-kubeconfig.yaml get pods --all-namespaces

Diagnose the kind of failure

A timeout usually calls for checking network connectivity, the active Tailscale connection and the cluster’s availability. Confirm the device is enrolled before changing Kubernetes credentials.

An authentication error calls for checking the credential expiry and downloading a fresh kubeconfig through Connect. A permissions error calls for checking your current access. Do not disable TLS verification or replace the private API address with an invented public one.

When sharing a support report, include the time, cluster reference and error text after removing secrets. Never include the kubeconfig, device key or access token.

When access is no longer needed

Use the access controls in Connect to revoke issued device keys and Kubernetes credentials. Revocation can remain pending if a required service is unreachable, so verify completion.

Cluster administrators can create additional credentials inside Kubernetes. Those credentials also need to be reviewed and revoked as part of your own cluster administration.