# Kubernetes access via an identity provider: Public client, not confidential

DevFeed: [Kubernetes access via an identity provider: Public client, not confidential](<https://devfeed.tech/articles/kubernetes-access-via-an-identity-provider-public-client-not-confidential-4599.md>)

Original publisher: [Read original article](<https://www.cncf.io/blog/2026/09/08/kubernetes-access-via-an-identity-provider-public-client-not-confidential/>)

Author: Kolawole Olowoporoku | CNCF Ambassador and Senior Platform Engineer

Published: 2026-09-08T11:30:00Z

Content type: tutorial

Language: en

Sources: [Cloud Native Computing Foundation](<https://devfeed.tech/sources/cloud-native-computing-foundation.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [client](<https://devfeed.tech/topics/client.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [architecture](<https://devfeed.tech/tags/architecture.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [blog](<https://devfeed.tech/tags/blog.md>), [browser](<https://devfeed.tech/tags/browser.md>), [iam](<https://devfeed.tech/tags/iam.md>), [identity](<https://devfeed.tech/tags/identity.md>), [integration](<https://devfeed.tech/tags/integration.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [on-prem](<https://devfeed.tech/tags/on-prem.md>), [operations](<https://devfeed.tech/tags/operations.md>)

## AI overview

The article explains how to replace static Kubernetes credentials with identity-provider login using a public OIDC client and PKCE. It describes kubectl with kubelogin, Keycloak, kube-apiserver token validation, and RBAC-based access decisions.

## Source excerpt

Access control belongs on the same day-zero checklist as networking and storage. On most on-prem clusters, it never makes the list. The Identity Gap Managed cloud Kubernetes ships IAM or SSO integration out of the box....