kubernetes.io

Get a Kubernetes API bearer token from your cluster's configured authentication mechanism, then place it in your kubeconfig or send it as Authorization: Bearer <token>. The Kubernetes docs note that kubectl uses kubeconfig to locate cluster information and user credentials; see Access Clusters Using the Kubernetes API, Authenticating, and Organizing Cluster Access Using kubeconfig Files.

Issue or obtain an X.509 client certificate and matching private key trusted by the target Kubernetes API server, then configure them in kubeconfig or present them in the TLS handshake. Kubernetes documents client certificate authentication and kubeconfig user entries for client certs in Authenticating and Organizing Cluster Access Using kubeconfig Files.

If the target cluster still enables basic authentication, obtain the username and password from the cluster administrator and configure them in kubeconfig or send them via HTTP Basic auth. Kubernetes documents static password file / basic auth as a supported authentication option in Authenticating and kubeconfig user fields in Organizing Cluster Access Using kubeconfig Files. Note that this mechanism is cluster-dependent and not universally enabled.

Create or obtain a kubeconfig file that contains the cluster endpoint plus one of the supported user credential methods (for example bearer token, client certificate, or basic auth). kubectl reads cluster access details from kubeconfig; see Command line tool (kubectl), Access Clusters Using the Kubernetes API, and Organizing Cluster Access Using kubeconfig Files.