diff --git a/.changeset/clean-fans-change.md b/.changeset/clean-fans-change.md
new file mode 100644
index 0000000000..fad4a9cfa6
--- /dev/null
+++ b/.changeset/clean-fans-change.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-kubernetes': patch
+---
+
+fix: kubernetes plugin shall pass id token on get clusters request if possible
diff --git a/plugins/kubernetes/src/api/KubernetesBackendClient.ts b/plugins/kubernetes/src/api/KubernetesBackendClient.ts
index 3f6a0394d3..4d44c021c4 100644
--- a/plugins/kubernetes/src/api/KubernetesBackendClient.ts
+++ b/plugins/kubernetes/src/api/KubernetesBackendClient.ts
@@ -79,10 +79,14 @@ export class KubernetesBackendClient implements KubernetesApi {
   }
 
   async getClusters(): Promise<{ name: string; authProvider: string }[]> {
+    const idToken = await this.identityApi.getIdToken();
     const url = `${await this.discoveryApi.getBaseUrl('kubernetes')}/clusters`;
 
     const response = await fetch(url, {
       method: 'GET',
+      headers: {
+        ...(idToken && { Authorization: `Bearer ${idToken}` }),
+      },
     });
 
     return (await this.handleResponse(response)).items;