Where apps hide your files

Finding your kubeconfig file

Updated 2026-10-28 · 5 min read

kubectl keeps clusters, users and contexts in one YAML file, normally ~/.kube/config. The file often holds credentials, so the useful skill is finding it and listing what is in it without printing the secrets.

The default location

~/.kube/config

That is the file kubectl reads when nothing else is set: the Kubernetes documentation says kubectl looks for a file named config in the $HOME/.kube directory. The file has no extension, and it sits in a hidden folder in your home directory. It is not necessarily named kubeconfig: any file used to configure cluster access is called a kubeconfig file.

Open the folder from Terminal:

open ~/.kube

Or in Finder, use Go > Go to Folder (⇧⌘G) and paste ~/.kube. If the folder does not exist, no tool has written a kubeconfig for you yet, or your tools write elsewhere (see below). The Mac used for this guide has no ~/.kube folder and no working kubectl, so the details here come from the Kubernetes documentation.

Check which file kubectl is really using

kubectl picks its configuration in this order, according to the Kubernetes docs:

1. The --kubeconfig flag. Only that file is used, with no merging.
2. The KUBECONFIG environment variable, a list of files that are merged.
3. Otherwise ~/.kube/config.

See whether the variable is set in your shell:

echo "$KUBECONFIG"

If it prints a list, those files are in play, and when they disagree the first file to set a value wins. Cloud tools and shell profiles (~/.zshrc) often set it. To list names without secrets, use kubectl's own commands, not cat:

kubectl config get-contexts
kubectl config current-context

kubectl config view prints the merged config. Without its --raw flag it leaves out certificate data and tokens, but treat its output as sensitive anyway and do not paste it into a ticket or chat.

Do not print or share the file

A kubeconfig can contain client certificates, private keys, bearer tokens or a command that fetches a token. Anyone holding the file can usually act as you on the cluster. The Kubernetes docs also warn the other way round: only use kubeconfig files from trusted sources, because a crafted one can run code on your Mac. List only names and permissions:

ls -la ~/.kube

The file should be readable by you only (permissions -rw-------). If it shows -rw-r--r--, other accounts on the Mac can read it, so tighten it with chmod 600 ~/.kube/config. That changes permissions only and does not edit the contents.

What is in the folder

Item	What it is
config	The kubeconfig: clusters, users and contexts, plus current-context
cache/	kubectl's cache folder (the default of its --cache-dir flag), which it rebuilds when needed
other files	Per-cluster or per-environment kubeconfig files you or a tool saved, such as dev-config

The Kubernetes docs give $HOME/.kube/cache as the default cache directory but do not describe its layout, so treat it as disposable and leave it alone unless a command is misbehaving.

Reading a context name

kubectl config get-contexts prints a table with the current context marked by an asterisk, plus the cluster and user each context points at. You switch with kubectl config use-context <name>, which changes the current-context value and nothing else. Cloud tools generate long names such as an ARN or a project path, so copy the name from the table instead of retyping it.

Who else writes to it

Anything that connects you to a cluster may add a context, and most such tools merge into ~/.kube/config when KUBECONFIG is not set: cloud CLIs (aws eks update-kubeconfig, gcloud container clusters get-credentials, az aks get-credentials), Docker Desktop's Kubernetes option, minikube and kind. That is why the file can grow without you editing it, and why a context can appear that you do not remember creating. Remove a stale one with kubectl config delete-context <name> rather than editing the YAML by hand.

Keeping files separate

You do not have to keep everything in one file. Save each cluster's file under ~/.kube, then point at the set you want:

export KUBECONFIG=$HOME/.kube/config:$HOME/.kube/dev-config

On macOS the list is separated by colons (Windows uses semicolons). A relative path inside a kubeconfig, such as a certificate file, is resolved relative to the kubeconfig's own folder. For one command only, use kubectl --kubeconfig ~/.kube/dev-config get pods.

Backing up or moving to a new Mac

Copy the file over a trusted channel, such as AirDrop between your own Macs or an encrypted drive. Do not email it or put it in a shared notes app. Many entries rely on helper commands (aws, gke-gcloud-auth-plugin) that must be installed on the new Mac too, and certificate paths that point into your old home folder will break. Often the cleaner route is to regenerate each cluster's entry on the new Mac with the cloud CLI that created it.

Why Finder and Spotlight skip it

.kube is a hidden dot-folder, and Spotlight and Finder searches leave hidden folders out of their results. A Finder search for "kube" will not show config, and the name config is too generic to search for on its own.

Finding it again later

Type .kube into Everywhere to jump to the folder, or dev-config (or whatever you named a second file) to find extra kubeconfigs scattered around. Hidden folders in your home are covered without any extra permission, so ~/.kube shows up as soon as it exists, and ⌘↵ reveals it in Finder. It matches file names only, so it cannot list which clusters a file contains: use kubectl config get-contexts for that.

Common questions

Where is the kubectl config file on a Mac?

At ~/.kube/config by default. If the KUBECONFIG environment variable or the --kubeconfig flag is set, kubectl uses that instead.

How do I see which kubeconfig kubectl is using?

Run echo "$KUBECONFIG". If it is empty and you passed no --kubeconfig flag, kubectl uses ~/.kube/config.

Can I list my clusters without printing tokens?

Yes. kubectl config get-contexts shows context, cluster and user names only. Avoid cat ~/.kube/config because the file may contain credentials.

Why is there no ~/.kube folder on my Mac?

It appears when kubectl or another tool first writes a kubeconfig. Without a cloud CLI, Docker Desktop Kubernetes, minikube or kind setup, it usually does not exist.