Skip to main content

Kubernetes CLI authentication

You can use the authentik Agent to authenticate to kubectl with authentik credentials.

Prerequisites​

authentik configuration​

To support the integration of authentik Agent with kubectl, you need to create an application/provider pair in authentik.

Create an application and provider in authentik for Kubernetes​

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Applications > Applications and click Create with Provider to create an application and provider pair. (Alternatively you can first create a provider separately, then create the application and connect it with the provider.)

    • Application: provide a descriptive name (e.g. authentik-kubernetes), an optional group for the type of application, the policy engine mode, and optional UI settings.
    • Choose a Provider type: select OAuth2/OpenID Connect as the provider type.
    • Configure the Provider: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
      • Set the Client type to Public.
      • Set the Client ID to authentik-kubernetes.
      • Select any available signing key.
      • Under Machine-to-Machine authentication settings add the authentik-cli provider as a Federated OIDC Provider.
    • Configure Bindings (optional): you can create a binding (policy, group, or user) to manage access to the application.

  3. Click Submit to save the new application and provider.

Kubernetes configuration​

To integrate the authentik Agent with your kubernetes deployment, you'll need to configure kubeadm.

Configure kubeadm settings​

Add the following extraArgs to your kubeadm_config.yml file:

- name: oidc-client-id
  value: authentik-kubernetes
- name: oidc-groups-claim
  value: groups
- name: oidc-groups-prefix
  value: "oidc:"
- name: oidc-issuer-url
  value: https://authentik.company/application/o/<application-slug>/
- name: oidc-username-claim
  value: email

Run the following command to apply the changes to an existing Kubernetes cluster:

warning

This command will restart the API server. Plan accordingly for production environments.

kubeadm upgrade apply <version> --config=kubeadm_config.yml

Where <version> matches the target Kubernetes version specified in your config file.

Example config file

An example kubeadm_config.yml is available on the authentik Platform GitHub repository.

Authenticate to kubectl with the authentik Agent​

To authenticate to kubectl with the authentik agent, use the following command:

ak auth kubectl

Available flags:

  • -c, --client-id <string> - Client ID
  • -h, --help - Display help information