kubelogin

A kubectl plugin for OpenID Connect authentication.

Runs as kubelogin|macOS, Linux, Windows|github.com

Open form in Otty otty.toml

Command form

ai-draft · 1 task · 7 fields

Fetch an OIDC token for kubectl with get-token. Password, client secret, TLS and logging options are left out.

Opens the form; the finished command lands at your prompt, unrun

Run in Otty

otty gui kubelogin

`kubelogin get-token`

Get an OIDC token

Run the credential plugin for one OIDC provider. Normally kubectl invokes this from kubeconfig; use it to test a provider.

Get an OIDC tokenExample values, fixed in this page — nothing here reaches a terminal

Basic

Issuer URL*

url

Client ID*

string

TasksEach one presets the form for one job

Get a token

issuer_urlclient_id

ParametersOnly these flags are editable in the form

Issuer URL

url

--oidc-issuer-url

Client ID

string

--oidc-client-id

Extra scope

string · repeatable

--oidc-extra-scope

Grant type

enum

--grant-typeautoauthcodeauthcode-keyboardpassworddevice-codeclient-credentials

Token cache storage

enum

--token-cache-storagediskkeyringnone

Do not open the browser

boolean

--skip-open-browser

Force token refresh

boolean

--force-refresh

SourcesEvery flag above is checked against these

usage

kubelogin get-token [flags] --oidc-issuer-url string Issuer URL of the provider (mandatory) --oidc-client-id string Client ID of the provider (mandatory) --oidc-extra-scope strings Scopes to request to the provider --force-refresh…

helpHEAD 2026-10-27

raw.githubusercontent.com

Before it fills your prompt, Otty checks the installed kubelogin against its version. A form that does not match your version is not offered.