Cluster access uses single sign-on via kubelogin — a public OIDC client with PKCE, so there are no secrets to hand out per machine.
curl -fsSL https://kubeconfig.bytelizard.net/install | sh
kubectl get nodes # opens a browser → sign in → done
After that, kubectl — and anything that reads the kubeconfig (k9s, Lens, Helm, flux) — signs itself in: a cached token with silent refresh, and only an occasional browser prompt. Re-running the install is safe.
You must be in a Kubernetes access group in the identity provider to sign in — that grants full or read-only access. Not in one yet? Ask an admin to add you.
Unauthorized after signing in → you're authenticated but not yet in an access group; ask an admin.