id = "kubelogin"
name = "kubelogin"
homepage = "https://github.com/int128/kubelogin"
description = "A kubectl plugin for OpenID Connect authentication."
executables = ["kubelogin"]
[dotfiles]
paths = []
secret = ["~/.kube/cache/oidc-login/"]
[commands]
format = 1
label = "kubelogin"
description = "Fetch an OIDC token for kubectl with get-token. Password, client secret, TLS and logging options are left out."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = false, short_bundles = false }
[[commands.subcommand]]
path = ["get-token"]
label = "Get an OIDC token"
description = "Run the credential plugin for one OIDC provider. Normally kubectl invokes this from kubeconfig; use it to test a provider."
[[commands.subcommand.source]]
id = "usage"
kind = "help"
url = "https://raw.githubusercontent.com/int128/kubelogin/HEAD/docs/usage.md"
revision = "HEAD 2026-10-27"
evidence = """
kubelogin get-token [flags]
--oidc-issuer-url string Issuer URL of the provider (mandatory)
--oidc-client-id string Client ID of the provider (mandatory)
--oidc-extra-scope strings Scopes to request to the provider
--force-refresh If set, refresh the ID token regardless of its expiration time
--token-cache-storage string Storage for the token cache. One of (disk|keyring|none) (default "disk")
--skip-open-browser [authcode] Do not open the browser automatically
--grant-type string Authorization grant type to use. One of (auto|authcode|authcode-keyboard|password|device-code|client-credentials) (default "auto")
"""
[[commands.subcommand.field]]
id = "issuer_url"
label = "Issuer URL"
type = "url"
option = ["--oidc-issuer-url"]
sources = ["usage"]
[[commands.subcommand.field]]
id = "client_id"
label = "Client ID"
type = "string"
option = ["--oidc-client-id"]
sources = ["usage"]
[[commands.subcommand.field]]
id = "extra_scope"
label = "Extra scope"
type = "string"
option = ["--oidc-extra-scope"]
multiple = true
sources = ["usage"]
[[commands.subcommand.field]]
id = "grant_type"
label = "Grant type"
type = "enum"
option = ["--grant-type"]
choices = [
{ value = "auto", label = "Auto" },
{ value = "authcode", label = "Authorization code" },
{ value = "authcode-keyboard", label = "Authorization code (keyboard)" },
{ value = "password", label = "Password" },
{ value = "device-code", label = "Device code" },
{ value = "client-credentials", label = "Client credentials" },
]
sources = ["usage"]
[[commands.subcommand.field]]
id = "token_cache_storage"
label = "Token cache storage"
type = "enum"
option = ["--token-cache-storage"]
choices = [
{ value = "disk", label = "Disk" },
{ value = "keyring", label = "Keyring" },
{ value = "none", label = "None" },
]
sources = ["usage"]
[[commands.subcommand.field]]
id = "skip_open_browser"
label = "Do not open the browser"
type = "boolean"
option = ["--skip-open-browser"]
sources = ["usage"]
[[commands.subcommand.field]]
id = "force_refresh"
label = "Force token refresh"
type = "boolean"
option = ["--force-refresh"]
sources = ["usage"]
[[commands.subcommand.task]]
id = "get-token"
label = "Get a token"
fields = ["issuer_url", "client_id"]
required = ["issuer_url", "client_id"]
[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["issuer_url", "client_id", "extra_scope", "grant_type"]
[[commands.subcommand.group]]
id = "advanced"
label = "Advanced"
fields = ["token_cache_storage", "skip_open_browser", "force_refresh"]
