kubelogin

{
  "aliases": [],
  "alternatives": [
    "kubectl",
    "aws-iam-authenticator",
    "dex"
  ],
  "build_dependencies": [
    "go"
  ],
  "categories": [
    "kubernetes",
    "security",
    "shell",
    "authentication"
  ],
  "caveats": null,
  "conflicts_with": [],
  "dependencies": [],
  "deprecated": 0,
  "deprecation_reason": null,
  "desc": "OpenID Connect authentication plugin for kubectl",
  "disable_reason": null,
  "disabled": 0,
  "enrichment_fetched_at": "2026-06-20T23:41:15+00:00",
  "first_seen": "2026-06-20T23:34:18+00:00",
  "full_name": "kubelogin",
  "github_default_branch": "master",
  "github_last_commit_at": "2026-06-20T22:14:44Z",
  "github_readme_excerpt": "# kubelogin [![go](https://github.com/int128/kubelogin/actions/workflows/go.yaml/badge.svg)](https://github.com/int128/kubelogin/actions/workflows/go.yaml) [![Go Report Card](https://goreportcard.com/badge/github.com/int128/kubelogin)](https://goreportcard.com/report/github.com/int128/kubelogin)\n\nThis is a kubectl plugin for [Kubernetes OpenID Connect (OIDC) authentication](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#openid-connect-tokens), also known as `kubectl oidc-login`.\n\nHere is an example of Kubernetes authentication with the Google Identity Platform:\n\n\u003cimg alt=\"screencast\" src=\"https://user-images.githubusercontent.com/321266/85427290-86e43700-b5b6-11ea-9e97-ffefd736c9b7.gif\" width=\"572\" height=\"391\"\u003e\n\nKubelogin is designed to run as a [client-go credential plugin](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins).\nWhen you run kubectl, kubelogin opens the browser and you can log in to the provider.\nThen kubelogin gets a token from the provider and kubectl access Kubernetes APIs with the token.\nTake a look at the diagram:\n\n![Diagram of the credential plugin](docs/credential-plugin-diagram.svg)\n\n## Getting Started\n\n### Setup\n\nInstall the latest release from [Homebrew](https://brew.sh/), [Krew](https://github.com/kubernetes-sigs/krew), [Chocolatey](https://chocolatey.org/packages/kubelogin) or [GitHub Releases](https://github.com/int128/kubelogin/releases).\n\n```sh\n# Homebrew (macOS and Linux)\nbrew install kubelogin\n\n# Krew (macOS, Linux, Windows and ARM)\nkubectl krew install oidc-login\n\n# Chocolatey (Windows)\nchoco install kubelogin\n```\n\nIf you install via GitHub releases, save the binary as the name `kubectl-oidc_login` on your path.\nWhen you invoke `kubectl oidc-login`, kubectl finds it by the [naming convention of kubectl plugins](https://kubernetes.io/docs/tasks/extend-kubectl/kubectl-plugins/).\nThe other install methods do this for you.\n\nYou need to set up the OIDC provider, c",
  "github_repo": "int128/kubelogin",
  "github_stars": 2298,
  "github_topics": [
    "golang",
    "kubectl",
    "kubectl-plugins",
    "kubernetes",
    "oidc",
    "openid-connect"
  ],
  "homepage": "https://github.com/int128/kubelogin",
  "homepage_og_description": null,
  "homepage_og_image": null,
  "homepage_title": null,
  "installs_30d": 1848,
  "installs_365d": 21543,
  "installs_90d": 5111,
  "keg_only": 0,
  "keg_only_reason": null,
  "last_seen": "2026-06-20T23:34:18+00:00",
  "license": "Apache-2.0",
  "llm_generated_at": "2026-06-20T23:48:26+00:00",
  "llm_model": "claude-haiku-4-5",
  "name": "kubelogin",
  "oldnames": [],
  "one_liner": "Go kubectl plugin for OpenID Connect authentication with automatic browser-based login flow.",
  "optional_dependencies": [],
  "rank_30d": 1011,
  "rank_365d": 1029,
  "rank_90d": 1082,
  "raw_hash": "bba0e8d4aaf45628",
  "recommended_dependencies": [],
  "revision": 0,
  "ruby_source_path": "Formula/k/kubelogin.rb",
  "tap": "homebrew/core",
  "test_dependencies": [
    "kubernetes-cli"
  ],
  "uses_from_macos": [],
  "version_head": "HEAD",
  "version_stable": "1.36.2",
  "versioned_formulae": [],
  "why_use_this": "Integrates OIDC providers (Google, Azure, Okta, etc.) into kubectl as a credential plugin, eliminating manual token management and handling automatic token refresh. Runs as a client-go credential plugin, so kubeconfig just references it\u2014when kubectl needs credentials, kubelogin opens your browser for login and handles token exchange transparently."
}