```
az aks get-credentials --resource-group [rg] --name [cluster] --overwrite-existing
kubectl get nodes
```
Traps:
- **Stale contexts.** Without `--overwrite-existing`, a context for the same cluster name keeps the old token/server address. After recreating a cluster with the same name, kubectl fails until you overwrite.
- **Admin vs user credentials.** `--admin` pulls cluster-admin kubeconfig, bypassing Azure RBAC. Default (non-admin) goes through Entra ID. If your automation suddenly gets forbidden errors after someone "fixed" the pipeline by switching to --admin, that is why; prefer fixing the Azure RBAC role assignment (Azure Kubernetes Service RBAC Cluster Admin / Reader) instead.
- **AAD-integrated clusters.** `kubelogin` is required for non-admin auth on Entra-integrated clusters. `az aks get-credentials` sets it up, but a hand-rolled kubeconfig without the kubelogin exec block gives "unauthorized".
- **Multiple subscriptions.** get-credentials runs against the current subscription. Wrong sub = "cluster not found". Always `az account set` first in scripts.
- **KUBECONFIG merging.** The command merges into ~/.kube/config by default. In CI, set KUBECONFIG to an empty temp file so you get exactly one context and nothing leaks between jobs.
Verify: `kubectl config current-context` shows the cluster you intended, and `kubectl auth can-i --list` reflects the permissions you expect.