live wire
▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸SECURITY · Red Hat’s first Security Signals report shifts focus from CVE counts to risk paths (Oct. 15)Red Hat▸PLATFORM · IBM adds non-destructive FlexVolume-to-CSI migration tool for OpenShift object storageIBM Cloud▸vLLM tests agent-built Kimi K3 decode path at up to 1.9× speedup; PR remains openvLLM▸AI · LeaderWorkerSet 1.0 changes rollout defaults for disaggregated AI workloadsKubernetes SIGs▸SECURITY · Red Hat flags active exploitation of kernel flaw affecting OpenShift CoreOS; no fix listedRed Hat Product Security▸AI · Red Hat sets Dec. 9 showcase for AI 3.6 agent governance and model servicesRed Hat▸vLLM 0.32.0 drops Python 3.10, restricts CORS defaults and adds security fixesvLLM▸SECURITY · Red Hat tracks Moderate Hono auth bypass across OpenShift AI, Dev Spaces and AnsibleRed Hat Product Security▸SECURITY · Red Hat Hardened Images fixes Moderate libpng denial-of-service flawRed Hat▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸SECURITY · Red Hat’s first Security Signals report shifts focus from CVE counts to risk paths (Oct. 15)Red Hat▸PLATFORM · IBM adds non-destructive FlexVolume-to-CSI migration tool for OpenShift object storageIBM Cloud▸vLLM tests agent-built Kimi K3 decode path at up to 1.9× speedup; PR remains openvLLM▸AI · LeaderWorkerSet 1.0 changes rollout defaults for disaggregated AI workloadsKubernetes SIGs▸SECURITY · Red Hat flags active exploitation of kernel flaw affecting OpenShift CoreOS; no fix listedRed Hat Product Security▸AI · Red Hat sets Dec. 9 showcase for AI 3.6 agent governance and model servicesRed Hat▸vLLM 0.32.0 drops Python 3.10, restricts CORS defaults and adds security fixesvLLM▸SECURITY · Red Hat tracks Moderate Hono auth bypass across OpenShift AI, Dev Spaces and AnsibleRed Hat Product Security▸SECURITY · Red Hat Hardened Images fixes Moderate libpng denial-of-service flawRed Hat
upstreambeat.ai
guidePLATFORM

Kube AuthKit gives Python tools one authentication path across Kubernetes and OpenShift

The Open Data Hub library combines kubeconfig, service accounts, OIDC and OpenShift OAuth while retaining strict TLS and standard Kubernetes clients.

Python auth paths unified for Kubernetes and OpenShift.
Side by side: what changed
By The News Desk· Oct 2, 2026the quick take — two AI hosts go live when you do

Python applications that move between a developer laptop, a Kubernetes pod and an OpenShift AI notebook often accumulate separate authentication branches for each environment. Kube AuthKit 0.4.0 offers a single API over four strategies: kubeconfig, in-cluster service accounts, OpenID Connect and OpenShift OAuth.

The Apache-2.0 library is maintained by the Open Data Hub community. It wraps the official Kubernetes Python client and returns its standard ApiClient, so applications can adopt the authentication layer without replacing their existing API calls.

How automatic selection works

The central call is get_k8s_client(AuthConfig(method="auto")). Kube AuthKit first looks for explicitly configured OIDC settings, then a bearer token, then in-cluster markers and a mounted service account. It falls back to the kubeconfig selected by KUBECONFIG or ~/.kube/config. That order lets one code path run locally and inside a cluster while still giving deliberate credentials priority over environmental discovery.

Teams that need more control can request a Kubernetes Configuration object before constructing the client, or retrieve a raw bearer token for custom HTTP calls. Configuration can come from Python objects, environment variables or dictionaries loaded from YAML or JSON.

OIDC and OpenShift choices

For OIDC, the library supports device authorization for command-line and headless workflows and authorization code with PKCE for browser-based applications. It discovers provider metadata, refreshes tokens and accepts custom certificate authorities for private PKI. OpenShift support can use a token such as the result of oc whoami -t, or discover the cluster's OAuth server for an interactive login.

Tokens are kept in memory by default. Developers who want sessions to survive process restarts can opt into the operating system keyring, allowing refresh credentials to live in macOS Keychain, GNOME Keyring or Windows Credential Vault rather than a plaintext file.

A sensible adoption path

Start with automatic mode only when the precedence matches the environments where the application will run. In CI, specify the intended strategy and inputs explicitly so an unexpected kubeconfig or token cannot silently change behavior. In pods and notebooks, grant the mounted service account only the RBAC permissions the application needs.

Keep the default TLS verification enabled. Kube AuthKit requires an explicit insecure setting to disable it, and the post recommends doing so only for local development. For private clusters, provide the custom CA instead. Finally, test token expiry and refresh behavior against the actual identity provider before rollout; unifying the client call reduces application branching, but it does not remove the need to validate provider policy, redirect URIs and cluster RBAC.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk