Skip to main content
Updated August 24, 2026 Every cluster exposes its API server on a public endpoint (https://<cluster-id>.k8s.raffusercloud.com:6443). Access is by the cluster’s kubeconfig. There are two ways to get one, and the difference is only about renewal: Every credential we issue expires. Rotating access invalidates all of them at once — see Cluster access and credentials.

​
Before you start

  • A cluster in Running state
  • kubectl installed locally

​
Steps

​
Option A — the CLI (nothing to renew)

The file it writes contains no credential: kubectl calls the Raff CLI for a short-lived token before each request. Anyone who copies the file cannot use it without your API key.

​
Option B — download from the dashboard

1

Download the kubeconfig

Open the cluster and click kubeconfig in the header (also available under Settings).
2

Point kubectl at it

You should see your control-plane and worker nodes in Ready state.
3

Deploy something

A downloaded kubeconfig grants full cluster-admin access until it expires (7 days by default). Store it like a password and never commit it to a repository. For CI and anything long-running, use the CLI instead — it keeps no credential on disk. You can also issue one from the API, and Settings → Access → Revoke invalidates every issued kubeconfig immediately.

​
Next steps

Expose a service

Reach your workload from the internet

View logs & metrics

Watch workloads without leaving the dashboard
Last modified on August 28, 2026