Note

When using bastion tunnel mode (provision_bastion=true, endpoint_public_access=false), the kubeconfig points to the cluster's private endpoint. You must establish an SSH tunnel before kubectl commands will succeed. When using public endpoint mode (endpoint_public_access=true), the kubeconfig works directly without a tunnel.

Context Naming Convention: kubectl context names match the cluster_name value from your tfvars.