`kubelogin` - client-go credential plugin for Entra ID (Azure AD) authentication to AKS

kubelogin convert-kubeconfig -l azurecli | kubelogin get-token ...

Options you will use

convert-kubeconfig -l azurecli: Rewrite the kubeconfig exec block to reuse the token from az login.

Examples

$ az aks get-credentials -g rg -n aks && kubelogin convert-kubeconfig -l azurecli

The usual pair on a machine where you are already logged in to az.

Gotchas

AKS clusters with Entra ID integration hand out a kubeconfig without a static token; kubectl calls kubelogin to get one.

Try kubelogin in a real terminal Free, in your browser - a real Ubuntu terminal to try it in, with missions that check your work.