Loading post…
Red HatSaad ZaherProblem & solution
Kube AuthKit: Unified Kubernetes and OpenShift auth in Python
Summary
Kube AuthKit is a lightweight Python library that unifies Kubernetes and OpenShift authentication behind a single API, eliminating conditional code paths across local, pod, notebook, and CI/CD environments. It supports four strategies—kubeconfig, in-cluster, OIDC, and OpenShift OAuth—auto-detected by an AuthFactory that probes environment variables and in-cluster markers in a defined order. The library handles token lifecycle transparently, with in-memory storage by default and optional OS keyring persistence for local development to avoid repeated logins. It provides two OIDC flows: device code for headless environments and authorization code with PKCE for interactive applications, both with automatic token refresh. Kube AuthKit returns a standard Kubernetes Python client ApiClient, ensuring full compatibility with the official library, and is actively maintained by the Open Data Hub community for OpenShift AI environments.
Context
Authentication fragmentation in Kubernetes and OpenShift Python applications: different environments (local development, pods, notebooks, CI/CD pipelines) require different authentication methods (kubeconfig, service account tokens, OIDC, OpenShift OAuth), each with its own setup and token lifecycle. The official Kubernetes Python client handles kubeconfig and in-cluster auth but leaves OIDC and OpenShift OAuth to the developer, leading to conditional code paths and duplicated token-handling logic.
Approach / What changed
The library uses the Strategy Pattern with four authentication strategies (kubeconfig, in-cluster service account, OIDC, and OpenShift OAuth) behind a common interface. An AuthFactory auto-detects the correct strategy by probing environment variables and in-cluster markers in a defined order. Token lifecycle management is handled transparently with in-memory storage by default and optional OS keyring persistence for local development. The library returns a standard Kubernetes Python client ApiClient.
Takeaways
Kube AuthKit reduces authentication to a single function call, auto-detecting the environment and selecting the correct strategy from kubeconfig, in-cluster, OIDC, or OpenShift OAuth.
It supports two OIDC flows: device code for headless environments and authorization code with PKCE for interactive applications, both with automatic token refresh.
Token lifecycle management is handled transparently with in-memory storage by default and optional OS keyring persistence to avoid repeated logins during local development.
FAQ
How does Kube AuthKit handle different environments?
Kube AuthKit uses an AuthFactory that probes environment variables and in-cluster markers in a defined order: first OIDC environment variables, then a Bearer token, then in-cluster markers (KUBERNETES_SERVICE_HOST and mounted service account), and finally falls back to kubeconfig. This auto-detection selects the correct authentication strategy without manual configuration.
What OIDC flows are supported?
It supports two OAuth 2.0 flows: device code flow for headless environments and CLI tools, and authorization code flow with PKCE for interactive user-facing applications. Both flows handle OIDC discovery automatically and manage token refresh.
How does token lifecycle management work?
Tokens are stored in-memory by default, which is secure for automated CI/CD pipelines and headless environments. Optionally, tokens can be persisted in the OS keyring (macOS Keychain, GNOME Keyring, or Windows Credential Vault) to avoid repeated authentication during local development; the first run requires interactive authentication, but subsequent runs reuse the stored refresh token silently.
Source and freshness
- Source
- developers.redhat.com
- Published
- Added to Yomu
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.