id       = "kubelogin"
name     = "kubelogin"
homepage = "https://github.com/int128/kubelogin"
description = "A kubectl plugin for OpenID Connect authentication."
executables   = ["kubelogin"]

[dotfiles]

# https://github.com/int128/kubelogin/blob/master/docs/usage.md documents the
# default --token-cache-dir as ~/.kube/cache/oidc-login and says the cache
# contains the ID token and refresh token. It is credential material rather
# than a reusable configuration file, so the complete directory is secret.
paths = []
secret = ["~/.kube/cache/oidc-login/"]

[commands]
format = 1
label = "kubelogin"
description = "Fetch an OIDC token for kubectl with get-token. Password, client secret, TLS and logging options are left out."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = false, short_bundles = false }

[[commands.subcommand]]
path = ["get-token"]
label = "Get an OIDC token"
description = "Run the credential plugin for one OIDC provider. Normally kubectl invokes this from kubeconfig; use it to test a provider."

[[commands.subcommand.source]]
id = "usage"
kind = "help"
url = "https://raw.githubusercontent.com/int128/kubelogin/HEAD/docs/usage.md"
revision = "HEAD 2026-10-27"
evidence = """
  kubelogin get-token [flags]
      --oidc-issuer-url string                          Issuer URL of the provider (mandatory)
      --oidc-client-id string                           Client ID of the provider (mandatory)
      --oidc-extra-scope strings                        Scopes to request to the provider
      --force-refresh                                   If set, refresh the ID token regardless of its expiration time
      --token-cache-storage string                      Storage for the token cache. One of (disk|keyring|none) (default "disk")
      --skip-open-browser                               [authcode] Do not open the browser automatically
      --grant-type string                               Authorization grant type to use. One of (auto|authcode|authcode-keyboard|password|device-code|client-credentials) (default "auto")
"""

[[commands.subcommand.field]]
id = "issuer_url"
label = "Issuer URL"
type = "url"
option = ["--oidc-issuer-url"]
sources = ["usage"]

[[commands.subcommand.field]]
id = "client_id"
label = "Client ID"
type = "string"
option = ["--oidc-client-id"]
sources = ["usage"]

[[commands.subcommand.field]]
id = "extra_scope"
label = "Extra scope"
type = "string"
option = ["--oidc-extra-scope"]
multiple = true
sources = ["usage"]

[[commands.subcommand.field]]
id = "grant_type"
label = "Grant type"
type = "enum"
option = ["--grant-type"]
choices = [
  { value = "auto", label = "Auto" },
  { value = "authcode", label = "Authorization code" },
  { value = "authcode-keyboard", label = "Authorization code (keyboard)" },
  { value = "password", label = "Password" },
  { value = "device-code", label = "Device code" },
  { value = "client-credentials", label = "Client credentials" },
]
sources = ["usage"]

[[commands.subcommand.field]]
id = "token_cache_storage"
label = "Token cache storage"
type = "enum"
option = ["--token-cache-storage"]
choices = [
  { value = "disk", label = "Disk" },
  { value = "keyring", label = "Keyring" },
  { value = "none", label = "None" },
]
sources = ["usage"]

[[commands.subcommand.field]]
id = "skip_open_browser"
label = "Do not open the browser"
type = "boolean"
option = ["--skip-open-browser"]
sources = ["usage"]

[[commands.subcommand.field]]
id = "force_refresh"
label = "Force token refresh"
type = "boolean"
option = ["--force-refresh"]
sources = ["usage"]

[[commands.subcommand.task]]
id = "get-token"
label = "Get a token"
fields = ["issuer_url", "client_id"]
required = ["issuer_url", "client_id"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["issuer_url", "client_id", "extra_scope", "grant_type"]

[[commands.subcommand.group]]
id = "advanced"
label = "Advanced"
fields = ["token_cache_storage", "skip_open_browser", "force_refresh"]