Kube AuthKit gives Python tools one authentication path across Kubernetes and OpenShift

Python applications that move between a developer laptop, a Kubernetes pod and an OpenShift AI notebook often accumulate separate authentication branches for each environment. Kube AuthKit 0.4.0 offers a single API over four strategies: kubeconfig, in-cluster service accounts, OpenID Connect and OpenShift OAuth.

The Apache-2.0 library is maintained by the Open Data Hub community. It wraps the official Kubernetes Python client and returns its standard ApiClient, so applications can adopt the authentication layer without replacing their existing API calls.

How automatic selection works

The central call is get_k8s_client(AuthConfig(method="auto")). Kube AuthKit first looks for explicitly configured OIDC settings, then a bearer token, then in-cluster markers and a mounted service account. It falls back to the kubeconfig selected by KUBECONFIG or ~/.kube/config. That order lets one code path run locally and inside a cluster while still giving deliberate credentials priority over environmental discovery.

Teams that need more control can request a Kubernetes Configuration object before constructing the client, or retrieve a raw bearer token for custom HTTP calls. Configuration can come from Python objects, environment variables or dictionaries loaded from YAML or JSON.

OIDC and OpenShift choices

For OIDC, the library supports device authorization for command-line and headless workflows and authorization code with PKCE for browser-based applications. It discovers provider metadata, refreshes tokens and accepts custom certificate authorities for private PKI. OpenShift support can use a token such as the result of oc whoami -t, or discover the cluster's OAuth server for an interactive login.

Tokens are kept in memory by default. Developers who want sessions to survive process restarts can opt into the operating system keyring, allowing refresh credentials to live in macOS Keychain, GNOME Keyring or Windows Credential Vault rather than a plaintext file.

A sensible adoption path

Start with automatic mode only when the precedence matches the environments where the application will run. In CI, specify the intended strategy and inputs explicitly so an unexpected kubeconfig or token cannot silently change behavior. In pods and notebooks, grant the mounted service account only the RBAC permissions the application needs.

Keep the default TLS verification enabled. Kube AuthKit requires an explicit insecure setting to disable it, and the post recommends doing so only for local development. For private clusters, provide the custom CA instead. Finally, test token expiry and refresh behavior against the actual identity provider before rollout; unifying the client call reduces application branching, but it does not remove the need to validate provider policy, redirect URIs and cluster RBAC.