<p>Our users are allowed to access Kubernetes clusters only from the management station, there is no possibility to access the API directly from their laptops/workstations.</p>

<p>Every user posses kubeconfig with relevant secrets belonging to this particular user. As the kubeconfig also contains the token used to authenticate against the Kubernetes API, it is not possible to store the kubeconfig "as is" on the management station file system.</p>

<p>Is there any way how to provide the token/kubeconfig to kubectl e.g. via STDIN, not exposing it to other users (e.g. admin of the management station) on the file system?</p>

<p>You could use bash process substitution to pass the entire <code>kubeconfig</code> to <code>kubectl</code> without saving it to a filesystem.</p>
<p>Something like this works for CI systems:</p>
<ol>
<li>Base64-encode your <code>kubeconfig</code> and store it securely</li>
</ol>
<pre><code>export KUBECONFIG_DATA=$(cat kubeconfig | base64 -w0)
</code></pre>
<ol start="2">
<li>Use process substitution to Base64-decode and pass it directly to <code>kubectl</code>:</li>
</ol>
<pre><code>kubectl --kubeconfig &lt;(echo $KUBECONFIG_DATA | base64 --decode) ...
</code></pre>
