Skip to main content
All Managed Service for Kubernetes clusters expose a public OpenID Connect (OIDC) discovery endpoint. External systems can use this endpoint to independently verify workload identities using JSON Web Tokens (JWT) that Kubernetes issues automatically. You can use this endpoint to let an external service trust your Managed Kubernetes cluster workloads.

​
OIDC endpoints

For every cluster, Managed Kubernetes exposes the following endpoints at https://oidc.mk8s.api.nebius.cloud: Both endpoints are accessible without authentication, so any OIDC-compatible service can fetch them directly.

​
How to get a cluster’s OIDC endpoint URLs

  1. Get the ID of your cluster by its name:
  2. Replace <cluster_ID> with your cluster ID in the endpoint URLs:
  3. Use these URLs when you register an OIDC identity provider or configure workload identity federation.