Authentication

Kipper uses browser-based authentication for both the web console and the CLI. The identity provider is Dex, deployed automatically during installation.

CLI authentication

After installing or importing a cluster, sign in to use its Kubernetes and console APIs:

kip auth login

  Logging in to example...

  Opening browser for authentication...

Your browser opens the Dex login page. After signing in, you'll see a confirmation page and the terminal shows:

  ✔  Authenticated as admin@203-0-113-10.kipper.run

How it works

1. The CLI starts a temporary local HTTP server on localhost:18741
2. Your browser opens the cluster's Dex authorization page (for example, https://dex--mycluster.kipper.run/dex)
3. You sign in with your Kipper credentials (the same ones you use for the web console)
4. Dex redirects back to the local server with an authorization code
5. The CLI exchanges the code directly with Dex for an ID token and refresh token
6. Tokens are stored in ~/.kip/auth.json (per cluster)

TIP

When you set a custom domain with kip cluster domain, the Dex URL moves with it (e.g. dex.kipper.example.com after moving to kipper.example.com). No manual configuration needed.

Token lifetime

A default Kipper installation configures:

• ID tokens: 15 minutes. The CLI refreshes them automatically while its refresh session remains valid.
• Refresh sessions: expire after 7 days of inactivity or 30 days in total. Sign in again after expiry.

These values come from Kipper's Dex configuration; an administrator may change them.

Run kip auth login again whenever you want a fresh session.

Check your auth status

kip auth status

  Cluster: example
  Email:   admin@203-0-113-10.kipper.run
  Status:  authenticated

Log out

kip auth logout

This removes stored tokens for the current cluster. Other clusters are not affected.

Console authentication

The web console authenticates through the same Dex instance. When you visit the console URL, you're redirected to the Dex login page. After signing in, a session token is stored in your browser.

Admin credentials

During kip install, an admin account is created automatically. The credentials are displayed once. Save them securely.

Reset the admin password

If you lose the admin password:

kip auth reset-password

  Admin password reset.
  Email:    admin@203-0-113-10.kipper.run
  Password: 5b2bf14ef6525...

If your kubeconfig requires a local session and none is available, kip retrieves the server's admin credentials over SSH and keeps them in memory. Pass --ssh-key <key> to use SSH explicitly, for example if your session lacks admin rights. SSH recovery logs in as root or as the cluster's SSH user, which needs passwordless sudo.

The SSH key is selected from --ssh-key, then KIP_SSH_KEY, then the key saved for the cluster. If none is set, kip uses OpenSSH's normal key selection with ~/.ssh/id_ed25519 as a fallback.

The command generates a new password, updates the Dex configuration, prints the credentials, and requests a Dex restart. You can sign in with the new password once Dex restarts.

Credentials are printed before Dex restarts. If the restart fails, the command reports the error, and the new password takes effect the next time Dex starts.