live wire
▸Red Hat ships important MicroShift 4.16.73 security updateRed Hat Product Errata▸AI · Red Hat maps local AI Inference serving and load tests on RHEL (Oct. 15)Red Hat Emerging Technologies▸PLATFORM · IBM guide maps Secure Execution VMs onto OpenShift Virtualization for LinuxONEIBM Community▸AI · vLLM maps Nemotron 3.5 Super VL across Hopper, Blackwell and Red Hat DSpark (Oct. 15)vLLM Recipes▸AI · AWS contributes push-based KV transfer to vLLM, reporting 3x better TTFT under loadAWS Machine Learning Blog▸AI · AWS contributes bidirectional KV transfer to vLLM, cutting multi-turn TTFT up to 3.3xAWS Machine Learning Blog▸AI · vLLM Semantic Router adds d3-turbo with box and video-tracking decisionsvLLM Semantic Router▸IDENTITY · Keycloak DevDay 2027 opens call for deep technical talks through Oct. 24Keycloak▸AI · vLLM Recipes maps Muse Spark Open to single-node Blackwell and AMD deployment (Oct. 16)vLLM▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸Red Hat ships important MicroShift 4.16.73 security updateRed Hat Product Errata▸AI · Red Hat maps local AI Inference serving and load tests on RHEL (Oct. 15)Red Hat Emerging Technologies▸PLATFORM · IBM guide maps Secure Execution VMs onto OpenShift Virtualization for LinuxONEIBM Community▸AI · vLLM maps Nemotron 3.5 Super VL across Hopper, Blackwell and Red Hat DSpark (Oct. 15)vLLM Recipes▸AI · AWS contributes push-based KV transfer to vLLM, reporting 3x better TTFT under loadAWS Machine Learning Blog▸AI · AWS contributes bidirectional KV transfer to vLLM, cutting multi-turn TTFT up to 3.3xAWS Machine Learning Blog▸AI · vLLM Semantic Router adds d3-turbo with box and video-tracking decisionsvLLM Semantic Router▸IDENTITY · Keycloak DevDay 2027 opens call for deep technical talks through Oct. 24Keycloak▸AI · vLLM Recipes maps Muse Spark Open to single-node Blackwell and AMD deployment (Oct. 16)vLLM▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security
upstreambeat.ai
guidePLATFORM

Kube AuthKit gives Python tools one authentication path across Kubernetes and OpenShift

The Open Data Hub library combines kubeconfig, service accounts, OIDC and OpenShift OAuth while retaining strict TLS and standard Kubernetes clients.

Python auth paths unified for Kubernetes and OpenShift.
Side by side: what changed
By The News Desk· Oct 2, 2026the quick take — two AI hosts go live when you do

Python applications that move between a developer laptop, a Kubernetes pod and an OpenShift AI notebook often accumulate separate authentication branches for each environment. Kube AuthKit 0.4.0 offers a single API over four strategies: kubeconfig, in-cluster service accounts, OpenID Connect and OpenShift OAuth.

The Apache-2.0 library is maintained by the Open Data Hub community. It wraps the official Kubernetes Python client and returns its standard ApiClient, so applications can adopt the authentication layer without replacing their existing API calls.

How automatic selection works

The central call is get_k8s_client(AuthConfig(method="auto")). Kube AuthKit first looks for explicitly configured OIDC settings, then a bearer token, then in-cluster markers and a mounted service account. It falls back to the kubeconfig selected by KUBECONFIG or ~/.kube/config. That order lets one code path run locally and inside a cluster while still giving deliberate credentials priority over environmental discovery.

Teams that need more control can request a Kubernetes Configuration object before constructing the client, or retrieve a raw bearer token for custom HTTP calls. Configuration can come from Python objects, environment variables or dictionaries loaded from YAML or JSON.

OIDC and OpenShift choices

For OIDC, the library supports device authorization for command-line and headless workflows and authorization code with PKCE for browser-based applications. It discovers provider metadata, refreshes tokens and accepts custom certificate authorities for private PKI. OpenShift support can use a token such as the result of oc whoami -t, or discover the cluster's OAuth server for an interactive login.

Tokens are kept in memory by default. Developers who want sessions to survive process restarts can opt into the operating system keyring, allowing refresh credentials to live in macOS Keychain, GNOME Keyring or Windows Credential Vault rather than a plaintext file.

A sensible adoption path

Start with automatic mode only when the precedence matches the environments where the application will run. In CI, specify the intended strategy and inputs explicitly so an unexpected kubeconfig or token cannot silently change behavior. In pods and notebooks, grant the mounted service account only the RBAC permissions the application needs.

Keep the default TLS verification enabled. Kube AuthKit requires an explicit insecure setting to disable it, and the post recommends doing so only for local development. For private clusters, provide the custom CA instead. Finally, test token expiry and refresh behavior against the actual identity provider before rollout; unifying the client call reduces application branching, but it does not remove the need to validate provider policy, redirect URIs and cluster RBAC.

sources

Filed by The News Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk