# Kubernetes Context Management

Patterns for managing multiple cluster contexts.

## Understanding Contexts

A kubeconfig context combines:
- **Cluster**: API server URL and CA certificate
- **User**: Authentication credentials
- **Namespace**: Default namespace (optional)

## Context Naming Conventions

### By Environment

```
production-us-east-1
production-eu-west-1
staging-us-east-1
development
```

### By Purpose

```
management-cluster
workload-cluster-1
workload-cluster-2
monitoring-cluster
```

### By Team

```
team-a-dev
team-a-prod
team-b-dev
platform-admin
```

## MCP Commands

```python
# List all contexts
list_contexts_tool()

# View kubeconfig (sanitized)
kubeconfig_view()
```

## Context in Every Command

All kubectl-mcp-server tools accept `context` parameter:

```python
# Explicit context (recommended)
get_pods(namespace="default", context="production")
get_pods(namespace="default", context="staging")

# Current context (implicit)
get_pods(namespace="default")
```

## Multi-Cluster Patterns

### Compare Environments

```python
# Get deployments from both clusters
prod_deps = get_deployments(namespace="app", context="production")
staging_deps = get_deployments(namespace="app", context="staging")
```

### Cross-Cluster Secret Sync

```python
# Read secret from source
secret = get_secrets(namespace="app", context="source-cluster")

# Apply to target (via manifest)
apply_manifest(secret_yaml, namespace="app", context="target-cluster")
```

### Parallel Health Checks

```python
contexts = ["prod-1", "prod-2", "staging"]
for ctx in contexts:
    nodes = get_nodes(context=ctx)
    pods = get_pods(namespace="kube-system", context=ctx)
    # Report status
```

### Rolling Deployment Across Clusters

```python
# Deploy to staging first
install_helm_chart(name="app", chart="./app",
                   namespace="prod", context="staging")

# Verify
get_pods(namespace="prod", label_selector="app=myapp", context="staging")

# Deploy to production regions sequentially
for region in ["us-east", "us-west", "eu-west"]:
    install_helm_chart(name="app", chart="./app",
                       namespace="prod", context=f"production-{region}")
    # Wait for healthy
    get_pods(namespace="prod", context=f"production-{region}")
```

## Access Control Per Context

### Separate Kubeconfigs

```bash
# Different files per environment
export KUBECONFIG=~/.kube/production.yaml
export KUBECONFIG=~/.kube/development.yaml
```

### Service Account Per Cluster

```python
# Different SAs for different access levels
# Production: read-only SA
get_pods(namespace="app", context="production-readonly")

# Development: full access SA
apply_manifest(manifest, namespace="app", context="development-admin")
```

## Cluster API Management

For managing cluster lifecycle:

```python
# List CAPI-managed clusters
capi_clusters_list_tool(namespace="capi-system")

# Get workload cluster kubeconfig
kubeconfig = capi_cluster_kubeconfig_tool(
    name="workload-cluster-1",
    namespace="capi-system"
)

# Use the kubeconfig to access workload cluster
# (save to file, add to contexts)
```

## Federation Patterns

### Kubefed Resources

Cross-cluster resource propagation with KubeFed.

### Cluster Mesh (Cilium)

```python
# Check Cilium cluster mesh status
cilium_nodes_list_tool(context="cluster-1")
cilium_nodes_list_tool(context="cluster-2")
```

### Multi-Cluster Service Mesh (Istio)

```python
istio_proxy_status_tool(context="primary")
istio_proxy_status_tool(context="remote")
```

## Best Practices

1. **Always Use Explicit Context**
   ```python
   # Good: explicit
   get_pods(context="production")

   # Risky: implicit
   get_pods()  # Which cluster?
   ```

2. **Naming Convention**
   - Consistent format: `<env>-<region>`
   - Short but descriptive

3. **Read-Only for Production**
   - Default production context: read-only
   - Separate admin context for changes

4. **Audit Cross-Cluster Operations**
   - Log which clusters are accessed
   - Track who made changes

5. **Separate Credentials**
   - Different SAs per environment
   - Shorter token lifetimes for prod

## Troubleshooting

### Context Not Found

```python
list_contexts_tool()
# Verify context name is correct
```

### Authentication Failure

```python
# Check credentials
# Token expired?
# Certificate valid?
```

### Network Issues

```
# API server reachable?
# VPN connected?
# Firewall rules?
```