Connect your first cluster

Where to find it

Start on Fleet, the Multi-cluster overview at /cluster. Each discovered kubeconfig context has a workflow card. Connect probes that context; selecting the card opens its cluster workspace. The active context is shown in the workspace header. The namespace picker is the 200-pixel button in that header whose accessible label starts with namespace: and whose visible value is the namespace name or all namespaces.

Prerequisites

• An installed build and a kubeconfig visible to the environment that launched Lumen.
• Network reachability to the API server and any credential helper required by the selected context.
• Kubernetes read permissions for the views you open. Lumen does not require cluster-admin for read-only browsing.

Connect and choose a scope

1. On Fleet, choose Connect on one context card. The label changes to connecting… while the probe runs. A successful card reports live health data; configuration diagnostics alone do not prove connectivity.
2. Select the card to open Workloads for that context.
3. Open the header’s namespace picker. Choose a discovered namespace or all namespaces.
4. If namespace listing is forbidden but you know the exact namespace, type it into filter or enter namespace…. For a valid Kubernetes name that is not in the list, select use namespace name. This selects a scope; it does not grant access.
5. Open workloads, then a family such as deployments or pods, and select a row to inspect it.

Expected result and recovery

The workspace header identifies the context and namespace. A successful list shows resources or an honest empty state. If a request is forbidden, keep the same known namespace and try a family your identity can read, or ask an administrator for the specific list/get/watch permission. Partial RBAC can leave one family unavailable while another works.

If no contexts appear, choose Diagnose kubeconfig in the empty Fleet state. If a card cannot connect, use its diagnostics action, correct the reported source, credential tool, TLS, network, or authorization problem, then choose Connect again. Rescan reloads local kubeconfig contexts; it does not prove API access.

Selecting all namespaces can require broader list permission and can return much more data. A forbidden source is shown as unavailable, not healthy-empty. See connection diagnostics and permissions.

Source: src/routes/cluster/FleetView.tsx, src/hooks/useNamespaceScope.ts, src/components/NamespacePicker.tsx at v0.18.0.