{"id":13522056,"url":"https://github.com/int128/kubelogin","last_synced_at":"2025-04-27T03:56:57.138Z","repository":{"id":39350263,"uuid":"126163087","full_name":"int128/kubelogin","owner":"int128","description":"kubectl plugin for Kubernetes OpenID Connect authentication (kubectl oidc-login)","archived":false,"fork":false,"pushed_at":"2025-04-24T18:14:00.000Z","size":3067,"stargazers_count":1932,"open_issues_count":98,"forks_count":207,"subscribers_count":15,"default_branch":"master","last_synced_at":"2025-04-27T03:56:51.018Z","etag":null,"topics":["golang","kubectl","kubectl-plugins","kubernetes","oidc","openid-connect"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/int128.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null},"funding":{"github":["int128"],"patreon":null,"open_collective":null,"ko_fi":null,"tidelift":null,"community_bridge":null,"liberapay":null,"issuehunt":null,"otechie":null,"custom":null}},"created_at":"2018-03-21T10:37:15.000Z","updated_at":"2025-04-26T13:54:29.000Z","dependencies_parsed_at":"2023-12-16T05:33:50.094Z","dependency_job_id":"8a0777b6-492f-4075-acd9-d5b07c594930","html_url":"https://github.com/int128/kubelogin","commit_stats":{"total_commits":1028,"total_committers":35,"mean_commits":29.37142857142857,"dds":0.4795719844357976,"last_synced_commit":"f1f2a37adc991aa5af8a76f51eab7a0bac26377a"},"previous_names":[],"tags_count":67,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/int128%2Fkubelogin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/int128%2Fkubelogin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/int128%2Fkubelogin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/int128%2Fkubelogin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/int128","download_url":"https://codeload.github.com/int128/kubelogin/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251085194,"owners_count":21533841,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["golang","kubectl","kubectl-plugins","kubernetes","oidc","openid-connect"],"created_at":"2024-08-01T06:00:41.649Z","updated_at":"2025-04-27T03:56:57.117Z","avatar_url":"https://github.com/int128.png","language":"Go","funding_links":["https://github.com/sponsors/int128"],"categories":["Go","kubernetes","Tools","kubectl Plugins","golang","Kubernetes"],"sub_categories":["Kubernetes","Installing plugins via awesome-kubectl-plugins","Kubernetes // Authentication"],"readme":"# kubelogin [![go](https://github.com/int128/kubelogin/actions/workflows/go.yaml/badge.svg)](https://github.com/int128/kubelogin/actions/workflows/go.yaml) [![Go Report Card](https://goreportcard.com/badge/github.com/int128/kubelogin)](https://goreportcard.com/report/github.com/int128/kubelogin)\n\nThis is a kubectl plugin for [Kubernetes OpenID Connect (OIDC) authentication](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens), also known as `kubectl oidc-login`.\n\nHere is an example of Kubernetes authentication with the Google Identity Platform:\n\n\u003cimg alt=\"screencast\" src=\"https://user-images.githubusercontent.com/321266/85427290-86e43700-b5b6-11ea-9e97-ffefd736c9b7.gif\" width=\"572\" height=\"391\"\u003e\n\nKubelogin is designed to run as a [client-go credential plugin](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins).\nWhen you run kubectl, kubelogin opens the browser and you can log in to the provider.\nThen kubelogin gets a token from the provider and kubectl access Kubernetes APIs with the token.\nTake a look at the diagram:\n\n![Diagram of the credential plugin](docs/credential-plugin-diagram.svg)\n\n## Getting Started\n\n### Setup\n\nInstall the latest release from [Homebrew](https://brew.sh/), [Krew](https://github.com/kubernetes-sigs/krew), [Chocolatey](https://chocolatey.org/packages/kubelogin) or [GitHub Releases](https://github.com/int128/kubelogin/releases).\n\n```sh\n# Homebrew (macOS and Linux)\nbrew install kubelogin\n\n# Krew (macOS, Linux, Windows and ARM)\nkubectl krew install oidc-login\n\n# Chocolatey (Windows)\nchoco install kubelogin\n```\n\nIf you install via GitHub releases, save the binary as the name `kubectl-oidc_login` on your path.\nWhen you invoke `kubectl oidc-login`, kubectl finds it by the [naming convention of kubectl plugins](https://kubernetes.io/docs/tasks/extend-kubectl/kubectl-plugins/).\nThe other install methods do this for you.\n\nYou need to set up the OIDC provider, cluster role binding, Kubernetes API server and kubeconfig.\nYour kubeconfig looks like this:\n\n```yaml\nusers:\n  - name: oidc\n    user:\n      exec:\n        apiVersion: client.authentication.k8s.io/v1\n        command: kubectl\n        args:\n          - oidc-login\n          - get-token\n          - --oidc-issuer-url=ISSUER_URL\n          - --oidc-client-id=YOUR_CLIENT_ID\n```\n\nSee the [setup guide](docs/setup.md) for more.\n\n### Run\n\nRun kubectl.\n\n```sh\nkubectl get pods\n```\n\nKubectl executes kubelogin before calling the Kubernetes APIs.\nKubelogin automatically opens the browser, and you can log in to the provider.\n\nAfter the authentication, kubelogin returns the credentials to kubectl.\nKubectl then calls the Kubernetes APIs with the credentials.\n\n```console\n% kubectl get pods\nOpen http://localhost:8000 for authentication\nNAME                          READY   STATUS    RESTARTS   AGE\nechoserver-86c78fdccd-nzmd5   1/1     Running   0          26d\n```\n\nKubelogin stores the ID token and refresh token to the cache.\nIf the ID token is valid, it just returns it.\nIf the ID token has expired, it will refresh the token using the refresh token.\nIf the refresh token has expired, it will perform re-authentication.\n\n## Troubleshooting\n\n### Token cache\n\nKubelogin stores the token cache to the file system by default.\nFor enhanced security, it is recommended to store it to the keyring.\nSee the [token cache](docs/usage.md#token-cache) for details.\n\nYou can log out by deleting the token cache.\n\n```console\n% kubectl oidc-login clean\nDeleted the token cache at /home/user/.kube/cache/oidc-login\nDeleted the token cache from the keyring\n```\n\nKubelogin will ask you to log in via the browser again.\nIf the browser has a cookie for the provider, you need to log out from the provider or clear the cookie.\n\n### ID token claims\n\nYou can run `setup` command to dump the claims of an ID token from the provider.\n\n```console\n% kubectl oidc-login setup --oidc-issuer-url=ISSUER_URL --oidc-client-id=REDACTED\n...\nYou got a token with the following claims:\n\n{\n  \"sub\": \"********\",\n  \"iss\": \"https://accounts.google.com\",\n  \"aud\": \"********\",\n  ...\n}\n```\n\nYou can set `-v1` option to increase the log level.\n\n```yaml\nusers:\n  - name: oidc\n    user:\n      exec:\n        apiVersion: client.authentication.k8s.io/v1\n        command: kubectl\n        args:\n          - oidc-login\n          - get-token\n          - -v1\n```\n\nYou can run the [acceptance test](acceptance_test) to verify if kubelogin works with your provider.\n\n## Docs\n\n- [Setup guide](docs/setup.md)\n- [Usage and options](docs/usage.md)\n- [Standalone mode](docs/standalone-mode.md)\n- [System test](system_test)\n- [Acceptance_test for identity providers](acceptance_test)\n\n## Contributions\n\nThis is an open source software licensed under Apache License 2.0.\nFeel free to open issues and pull requests for improving code and documents.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fint128%2Fkubelogin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fint128%2Fkubelogin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fint128%2Fkubelogin/lists"}