Connect with kubectl

Once your cluster is Ready, you connect to it with kubectl using the admin kubeconfig you download from the portal.

Private by default

By default, your cluster’s Kubernetes API server is reachable only from within the cluster’s private network — the network where your worker nodes live. This keeps the API server off the public internet unless you explicitly choose otherwise.

Optional public endpoint

If you want to reach the cluster from your laptop or CI pipeline, you can enable a public API server endpoint for the cluster. When enabled, your cluster gets a stable public domain of the form:

<cluster>.<org>.<region>.aetherplatform.cloud:6443

The public endpoint is protected by:

• Authorized networks — IP allow-listing, so only ranges you specify can reach the API server.
• Connection rate limiting — to absorb abusive traffic.

The kubeconfig you download always targets whichever endpoint you currently have enabled (private or public).

Caution

If you enable the public endpoint, lock it down to known IP ranges via authorized networks — your office, your VPN, and your CI provider’s egress ranges. Don’t leave it open to the world.

Connect

1. In the portal, open your cluster and click Download kubeconfig.

2. Point kubectl at the downloaded file:

   export KUBECONFIG=~/Downloads/<cluster>-kubeconfig.yaml

3. Verify the connection:

   kubectl get nodes

   You should see the worker nodes from your pools listed in Ready state.

Merging into your existing kubeconfig

To keep multiple clusters in one file, merge the downloaded kubeconfig into ~/.kube/config:

KUBECONFIG=~/.kube/config:~/Downloads/<cluster>-kubeconfig.yaml \
  kubectl config view --flatten > ~/.kube/config.new && mv ~/.kube/config.new ~/.kube/config

Then switch to the new context with kubectl config use-context <cluster>.

Next steps

• Networking — expose your workloads.
• Storage — add persistent volumes.