Kubectl multicluster

# Install kubectl
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
chmod +x kubectl
sudo mv kubectl /usr/local/bin/

# Install kubelogin (oidc-login)
# For Linux
curl -LO https://github.com/int128/kubelogin/releases/latest/download/kubelogin_linux_amd64.zip
unzip kubelogin_linux_amd64.zip
chmod +x kubelogin
sudo mv kubelogin /usr/local/bin/

# Add first cluster
kubectl config set-cluster cluster1 \
  --server=https://api.cluster1.example.com \
  --certificate-authority=cluster1-ca.crt

kubectl config set-credentials user1 \
  --auth-provider=oidc \
  --auth-provider-arg=idp-issuer-url=https://issuer.example.com \
  --auth-provider-arg=client-id=your-client-id \
  --auth-provider-arg=client-secret=your-client-secret \
  --auth-provider-arg=refresh-token=your-refresh-token

kubectl config set-context cluster1 \
  --cluster=cluster1 \
  --user=user1 \
  --namespace=default

# Add second cluster
kubectl config set-cluster cluster2 \
  --server=https://api.cluster2.example.com \
  --certificate-authority=cluster2-ca.crt

kubectl config set-credentials user2 \
  --auth-provider=oidc \
  --auth-provider-arg=idp-issuer-url=https://issuer.example.com \
  --auth-provider-arg=client-id=your-client-id \
  --auth-provider-arg=client-secret=your-client-secret

kubectl config set-context cluster2 \
  --cluster=cluster2 \
  --user=user2 \
  --namespace=default

# Login to cluster1
kubectl oidc-login --context=cluster1

# Login to cluster2  
kubectl oidc-login --context=cluster2

#!/bin/bash
# kubectl-auth.sh

CONTEXT=$1
shift

# Refresh token if needed
kubectl oidc-login --context=$CONTEXT --skip-open-browser > /dev/null 2>&1

# Execute kubectl command
kubectl --context=$CONTEXT "$@"

./kubectl-auth.sh cluster1 get pods
./kubectl-auth.sh cluster2 get nodes

# ~/.kube/kubelogin.yaml
- name: cluster1-login
  context: cluster1
  oidc:
    issuerUrl: https://issuer.example.com
    clientId: cluster1-client-id
    clientSecret: cluster1-client-secret
    extraScopes: ["email", "groups"]

- name: cluster2-login  
  context: cluster2
  oidc:
    issuerUrl: https://issuer2.example.com
    clientId: cluster2-client-id
    clientSecret: cluster2-client-secret

# Список контекстов
kubectl config get-contexts

# Переключение на конкретный кластер
kubectl config use-context cluster1

# Верификация контекста
kubectl config current-context

# Запуск команд без переключения контекста
kubectl --context=cluster1 get pods
kubectl --context=cluster2 get nodes