# Install kubelogin with Homebrew, chocolatey, Nix, scoop, winget, zypper, apk OpenID Connect authentication plugin for kubectl. Version 1.36.2 via Homebrew; verified 2026-05-30. ## Install ```sh sudo av install brew:kubelogin ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install kubelogin ``` Evidence: local Homebrew formula metadata ### Linux - Nix (92%): ```sh nix profile install nixpkgs#kubelogin ``` Evidence: nixpkgs package indexes: pkgs/by-name/ku/kubelogin/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - zypper (92%): ```sh sudo zypper install kubelogin ``` Evidence: openSUSE Tumbleweed package metadata: kubelogin from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst - apk (92%): ```sh sudo apk add kubectl-oidc_login ``` Evidence: Alpine Linux edge package indexes: kubectl-oidc_login from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz ### Windows - Chocolatey (92%): ```sh choco install kubelogin ``` Evidence: Chocolatey community package catalog: kubelogin from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','kubectx' - Scoop (92%): ```sh scoop install extras/kubelogin ``` Evidence: Scoop official bucket manifest trees: bucket/kubelogin.json from https://api.github.com/repos/ScoopInstaller/Extras/git/trees/master?recursive=1 - winget (92%): ```sh winget install --id int128.kubelogin -e ``` Evidence: Windows Package Manager source index: int128.kubelogin from https://cdn.winget.microsoft.com/cache/source.msix ## Package facts - **Package key:** brew:kubelogin - **Package manager:** Homebrew - **Package manager page:** - **Version:** 1.36.2 - **Source summary:** OpenID Connect authentication plugin for kubectl - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** Apache-2.0 - **Source archive:** - **Last updated:** 2026-05-30T14:48:58Z - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - kubectl-oidc_login (cli) - kubectl-oidc_login (alias) ## Build dependencies - go ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 1.36.2 - Package-manager updated: 2026-05-30 - Local data: ok - Upstream repository: https://github.com/int128/kubelogin - Upstream latest detected: v1.36.2 (current) ## Project history and usage int128/kubelogin is a kubectl plugin for Kubernetes OpenID Connect authentication, also known as kubectl oidc-login. It became important as Kubernetes client authentication moved toward exec credential plugins and as clusters increasingly delegated user login to OIDC identity providers. ### Project history The public GitHub repository was created on March 21, 2018. The README identifies kubelogin as a kubectl plugin for Kubernetes OIDC authentication and explains that it is designed to run as a client-go credential plugin. The project tracks Kubernetes exec credential APIs and browser-based OIDC login flows. Its CLI can be invoked through kubectl plugin naming as kubectl oidc-login, and it stores token cache data in the filesystem by default with an option to use the system keyring. ### Adoption history kubelogin gained adoption because Kubernetes documented client-go credential plugins as a stable feature in Kubernetes v1.22. That mechanism lets kubectl and client-go execute an external command to receive user credentials for authentication protocols such as OAuth2 and SAML. The README documents installation through Homebrew, Krew, Chocolatey, and GitHub Releases. The package also appears in apk, Nix, Scoop, winget, and zypper metadata in the batch input, showing that an authentication helper crossed from Kubernetes plugin culture into general OS package managers. ### How it is used When kubectl runs, kubelogin opens a browser for the user to authenticate with an OIDC provider, obtains a token, and returns Kubernetes ExecCredential output for client-go. The kubeconfig user.exec stanza points to the plugin command and arguments. The default token cache path documented by the README is ~/.kube/cache/oidc-login, and kubectl oidc-login clean deletes cached credentials so the next kubectl run starts a fresh browser login. ### Why package nerds care kubelogin is significant because it is both a kubectl plugin and a security-sensitive credential helper. Packaging matters here: users want a reproducible binary from Homebrew, Krew, Chocolatey, or distro packages because the tool participates directly in Kubernetes API authentication. ### Timeline - 2018-03-21: Public GitHub repository created - 2021: Kubernetes v1.22 marked client-go credential plugins stable - 2026-05-30: v1.36.2 release published - 2026: README documented Homebrew, Krew, Chocolatey, and GitHub Releases installation paths ### Related projects - Kubernetes client-go credential plugins provide the exec-plugin mechanism kubelogin implements. - Krew distributes kubelogin as the oidc-login kubectl plugin. - OpenID Connect and OAuth2 identity providers are the authentication systems kubelogin bridges into kubectl. ### Sources - - - - - - ## Security Notes narrow executable package without higher-risk signals. - **Geiger risk:** green / low - narrow executable package without higher-risk signals ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Unix: ~/.kube/config ## Credential files - Unix: ~/.kube/cache/oidc-login ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** kubelogin - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Nix - kubelogin: normalized package name match | nixpkgs package indexes: pkgs/by-name/ku/kubelogin/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - zypper - kubelogin - 0.2.18-1.1: normalized package name match | openSUSE Tumbleweed package metadata: kubelogin from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Kubernetes client credential plugin implementing Azure authentication | https://github.com/Azure/kubelogin - Chocolatey - kubelogin: normalized package name match | Chocolatey community package catalog: kubelogin from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','kubectx' - Scoop - extras/kubelogin: normalized package name match | Scoop official bucket manifest trees: bucket/kubelogin.json from https://api.github.com/repos/ScoopInstaller/Extras/git/trees/master?recursive=1 - winget - int128.kubelogin: normalized package name match | Windows Package Manager source index: int128.kubelogin from https://cdn.winget.microsoft.com/cache/source.msix - apk - kubectl-oidc_login - 1.35.2-r3: installed executable or alias match | Alpine Linux edge package indexes: kubectl-oidc_login from https://dl-cdn.alpinelinux.org/alpine/edge/testing/x86_64/APKINDEX.tar.gz | kubectl plugin for Kubernetes OpenID Connect authentication | https://github.com/int128/kubelogin ## Related links - [Cloud CLI packages](https://www.automicvault.com/pkg/cloud-clis/) - Belongs to a cloud or infrastructure command family. - [Source-control packages](https://www.automicvault.com/pkg/source-control-tools/) - Belongs to a source-control command family. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Text processing packages](https://www.automicvault.com/pkg/text-processing-tools/) - Matched text, document, or structured-data processing metadata. - [go](https://www.automicvault.com/pkg/brew/go/) - Build dependency declared by Homebrew. - [krew](https://www.automicvault.com/pkg/brew/krew/) - Shares av.db curated category or tags: cli, developer-tools, kubectl, kubernetes. - [kubecm](https://www.automicvault.com/pkg/brew/kubecm/) - Shares av.db curated category or tags: cli, developer-tools, kubectl, kubernetes. - [kubecolor](https://www.automicvault.com/pkg/brew/kubecolor/) - Shares av.db curated category or tags: cli, developer-tools, kubectl, kubernetes. - [kubectl-ai](https://www.automicvault.com/pkg/brew/kubectl-ai/) - Shares av.db curated category or tags: cli, developer-tools, kubectl, kubernetes. - [kubectl-tree](https://www.automicvault.com/pkg/brew/kubectl-tree/) - Shares av.db curated category or tags: cli, developer-tools, kubectl, kubernetes. - [kubectx](https://www.automicvault.com/pkg/brew/kubectx/) - Shares av.db curated category or tags: cli, developer-tools, kubectl, kubernetes. - [kubergrunt](https://www.automicvault.com/pkg/brew/kubergrunt/) - Shares av.db curated category or tags: cli, developer-tools, kubectl, kubernetes. - [kubernetes-cli](https://www.automicvault.com/pkg/brew/kubernetes-cli/) - Shares av.db curated category or tags: cli, developer-tools, kubectl, kubernetes. ## Combined YAML source View the package source record on GitHub. [combined/kubelogin.yml](https://github.com/automic-vault/db/blob/main/combined/kubelogin.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph