kubectl login

Suggested reading

Read the Identity overview first for the token flows Hub supports.

Hub's API is Kubernetes-shaped, so kubectl talks to it directly once it knows how to get a Hub token. hub-credential-helper plugs into kubectl as a client-go ExecCredential plugin, which makes token acquisition and refresh transparent on every command.

Wire up the kubeconfig

Point a kubeconfig user at the helper:

users:
  - name: hub-user
    user:
      exec:
        apiVersion: client.authentication.k8s.io/v1
        command: hub-credential-helper
        args:
          - exec-credential
          - --hub-url=https://hub.example.com
        interactiveMode: IfAvailable

Combine that user stanza with matching clusters and contexts entries pointing at the Hub API URL.

interactiveMode: IfAvailable lets the helper run the interactive device flow when it has no cached token and a terminal is attached. In a CI job, where no one can approve a login, give the helper a JWT to exchange instead — see workload identities.

What you can run

With the plugin in place, kubectl authenticates automatically:

kubectl auth whoami
kubectl get controlplanes -A
kubectl get realmrolebindings -n <realm>
kubectl get identityproviders

kubectl auth whoami is the one to reach for first — it posts a SelfSubjectReview and shows the exact username and groups Hub resolved for you, which is what every role binding matches against. See Verifying your identity.

Related resources

• CLI and AI agent login — logging in interactively and printing a token for other clients.
• Workload identities — the non-interactive counterpart for CI jobs and ServiceAccounts.
• Access management — what your identity is allowed to do once kubectl can reach Hub.
• Filtering and self-review — why a kubectl get returns the rows it does.