Kubeconfig editor

The kubeconfig editor is a form and a raw YAML view of the same file. Comments in the file are preserved, the YAML tab is schema-validated and secrets are masked with a reveal toggle.

Open it from the palette: Kubeconfig: New…, Edit Current Context, Test Current Context, Import from Cloud CLI… or, in the release after 0.6.0, Discover Cloud Clusters (EKS, AKS, GKE)….

The new-cluster wizard#

1. Name the context.
2. Cluster: the server URL and its CA. Use system trust, a file, pasted PEM, or fetch it from the server after confirming its fingerprint.
3. Credentials: client certificate, token, token file, exec plugin, OIDC provider or none. Exec presets cover AWS EKS, GKE, AKS (kubelogin) and OIDC (kubelogin).
4. Context: user, cluster and default namespace.
5. Test the connection.
6. Save.

Connection test#

The test walks through DNS and TCP, TLS, credentials, the API server, authentication, permissions and latency. Where it can, it offers the fix: fetching the CA, showing an install hint for a missing plugin, signing in or replacing the token.

Importing#

• From a connected cluster: create a kubeconfig for a service account using a TokenRequest, with an expiry by default.
• From a cloud CLI: AWS (aws), Google (gcloud) and Azure (az). Kubyl shows the commands before running them. Cloud CLI arguments containing cmd.exe metacharacters are refused on Windows.

Cloud discovery#

Instead of importing one cluster at a time, Kubeconfig: Discover Cloud Clusters (EKS, AKS, GKE)… (or Discover cloud clusters… in the new-kubeconfig wizard) lists the clusters in your cloud accounts. It uses the CLIs you already have, so sign in with them first.

1. Pick the tab for a cloud and press Scan. Accounts and regions appear as they finish, with at most six commands running at once.
2. Tick whole accounts or single clusters. Problems show next to the account or region they belong to.
3. Press Add N clusters. Kubyl runs the same get-credentials commands as the single-cluster import (aws eks update-kubeconfig, az aks get-credentials, gcloud container clusters get-credentials) in a private temporary folder and opens the result as an unsaved Kubyl-owned kubeconfig in the editor. Test it, then save. Clusters that failed are listed in a toast.

Each command has a 60-second timeout and runs without prompts or a pager, with the PATH of your login shell. Nothing is persisted: the results live in the dialog. Failures say what to do, for example aws sso login --profile X for an expired SSO session, az login or gcloud auth login, which permission is missing (eks:ListClusters, Microsoft.ContainerService/managedClusters/read, container.clusters.list), or how to enable the Kubernetes Engine API in a project.

Saving safely#

• A preview of the change is shown before saving.
• Kubyl refuses to overwrite a file that changed on disk since it was loaded.
• A timestamped backup goes to kubeconfig-backups/ (the last 10 are kept, mode 0600, see kubeconfig_editor.backups_kept).
• Writes are atomic. Symlinks are followed. New files and files with inline credentials get mode 0600.

Which files you can edit#

Files Kubyl owns, those under kubeconfigs/, are freely editable. External files (~/.kube/config, $KUBECONFIG files and ones you added) need a per-file opt-in via Edit this file. kubeconfig_editor.allow_external_edits (default on) controls whether the opt-in is offered at all, and editable_files remembers your choices. Save as a Kubyl copy always works.