- Set KUBECONFIG env at job level for all steps - Generate kubeconfig from ServiceAccount token - Use tokenFile reference for automatic token renewal - Set proper cluster CA and server URL - Test connection after setup This ensures kubectl works correctly inside K8s Pod runner