---
name: containers-cluster-access-public
title: Accessing clusters through the public cloud service endpoint
description: For IBM Cloud Kubernetes Service Classic and VPC clusters that have a public cloud service endpoint enabled, you can log in from the CLI or a graphical dashboard.
last-updated: 2026-08-20
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/containers?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Accessing clusters through the public cloud service endpoint
{: #cluster-access-public}

For IBM Cloud Kubernetes Service Classic and VPC clusters that have a public cloud service endpoint enabled, you can log in from the CLI or a graphical dashboard.
{: shortdesc}

## Before you begin
{: #access-public-prereqs}

1. [Install the required CLI tools](https://cloud.ibm.com/docs/containers?topic=containers-cli-install&format=markdown), including the IBM Cloud CLI, Kubernetes Service plug-in (`ibmcloud ks`), and Kubernetes CLI (`kubectl`). For quick access to test features in your cluster, you can also use the [IBM Cloud Shell](https://cloud.ibm.com/docs/containers?topic=containers-cli-install&format=markdown).
1. If your network is protected by a company firewall, [allow access](https://cloud.ibm.com/docs/containers?topic=containers-firewall&format=markdown#corporate) to the IBM Cloud and IBM Cloud Kubernetes Service API endpoints and ports.
1. Verify your cluster is healthy: `ibmcloud ks cluster get -c CLUSTER_NAME_OR_ID`.

## Connecting from the CLI
{: #access-public-cli}

1. Download and add the `kubeconfig` configuration file for your cluster to your existing `kubeconfig` in `~/.kube/config` or the last file in the `KUBECONFIG` environment variable.
    ```sh
    ibmcloud ks cluster config -c CLUSTER_NAME_OR_ID
    ```
    {: pre}

1. Verify that `kubectl` commands run properly and that the Kubernetes context is set to your cluster.
    ```sh
    kubectl config current-context
    ```
    {: pre}

    Example output
    ```sh
    <cluster_name>/<cluster_ID>
    ```
    {: screen}

## Connecting to the Headlamp dashboard
{: #access-public-dashboard}

[Headlamp](https://cloud.ibm.com/docs/containers?topic=containers-headlamp-addon&format=markdown) is the recommended graphical dashboard for managing and monitoring your cluster resources. It uses IBM Cloud IAM authentication and is automatically exposed through your cluster's default ingress hostname after you install the add-on.

1. [Install the Headlamp add-on](https://cloud.ibm.com/docs/containers?topic=containers-headlamp-addon&format=markdown#headlamp-install) if you haven't already.
1. Get your cluster's default ingress hostname.
    ```sh
    ibmcloud ks cluster get -c CLUSTER_NAME_OR_ID | grep "Ingress Subdomain"
    ```
    {: pre}

1. Open `https://headlamp.<ingress_subdomain>` in a browser and click **Sign In**.

### Legacy: Connecting with kubectl proxy
{: #access-public-dashboard-legacy}

The upstream `kubernetes-dashboard` project is archived and no longer installed on new clusters as of version 1.36. Use [Headlamp](#access-public-dashboard) instead.
{: deprecated}

If your cluster still has the legacy Kubernetes dashboard installed:

1. Start a local proxy.
    ```sh
    kubectl proxy
    ```
    {: pre}

1. Open the following URL in a web browser.
    ```sh
    http://localhost:8001/api/v1/namespaces/kube-system/services/https:kubernetes-dashboard:/proxy/
    ```
    {: codeblock}

## Connecting with an API key
{: #access-public-cli-apikey}

See [Accessing clusters from automation tools by using an API key](https://cloud.ibm.com/docs/containers?topic=containers-cluster-access-automation&format=markdown).