A managed Kubernetes cluster with a node group, an RBAC user role, and a cluster user whose kubeconfig you can hand to a developer. This assumes the Networking example's demo folder and demo-subnet already exist.

First look up the subnet's id. Inside spec.controlPlaneLocations the subnet must be a real ULID — kc resolves names only for fields sitting directly on spec (or metadata), never inside a nested list. -n demo is required too: without it kc get only searches the default folder.

Paste that id into controlPlaneLocations[0].vpcSubnetId. The node group's own spec.kubernetesId / spec.vpcSubnetId and the user's spec.roleIds are ordinary spec fields, so those stay written as names:

Then apply it:

Getting the kubeconfig

Provisioning a control plane takes tens of minutes, and Kubernetes changes are serialized per organization — the node group, role and user each wait their turn. Once kc get k8s-user demo-dev -n demo reports stable, the generated kubeconfig is on the user's status:

The role above grants read-only access to pods and services in default only — a user with no roles can authenticate but do nothing. Scale the pool by raising desiredNodeCount and re-applying.

Related pages

Resource docs

• Kubernetes Cluster resource docs
• Node Group resource docs
• User Role resource docs
• Cluster User resource docs
• VPC Subnet resource docs

More in this section

• Networking
• VMs
• VPN
• Load Balancing
• S3
• Examples