Connecting to Kubernetes Cluster (OIDC)

Clusters authenticate via OIDC (Authentik). You log in with your browser through kubectl’s oidc-login exec plugin — no static credentials needed.

Prerequisites

• Having kubectl, ansible-playbook and the kubelogin-oidc installed.
• SSH/Ansible access to the target cluster’s inventory.
• OIDC must already be set up on the cluster (see docs/setup/kubelogin-oidc.md).

1. Generate your kubeconfig

Clone Git repository:

git clone git@__GITLAB_URL__:foundation/infrastructure.git
cd infrastructure

Run inside the infrastructure repository the Ansible playbook:

ansible-playbook -i inventories/__ENV__/ playbooks/k8s_oidc_login.yml

This writes to the kube config (default $HOME/.kube/config). Re-run it any time to regenerate the file.

2. Connect

Show the current contexts:

kubectl config get-contexts

Use the correct context:i

kubectl config use-context __ENV__

Run kubectl commands:

kubectl get nodes

The first kubectl call opens a browser for Authentik login. The token is then cached ($HOME/.kube/cache/oidc-login) and refreshed automatically until it expires, after which the browser flow runs again.