diff --git a/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.test.ts b/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.test.ts
index cca2b28fcf..6fb33d8b3a 100644
--- a/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.test.ts
+++ b/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.test.ts
@@ -228,6 +228,34 @@ describe('ConfigClusterLocator', () => {
     ]);
   });
 
+  it('prefers authMetadata block to top-level keys', async () => {
+    const sut = ConfigClusterLocator.fromConfig(
+      new ConfigReader({
+        clusters: [
+          {
+            name: 'cluster',
+            url: 'http://url',
+            authProvider: 'aws',
+            authMetadata: {
+              [ANNOTATION_KUBERNETES_AUTH_PROVIDER]: 'serviceAccount',
+            },
+          },
+        ],
+      }),
+      authStrategy,
+    );
+
+    const result = await sut.getClusters();
+
+    expect(result).toMatchObject([
+      {
+        authMetadata: {
+          [ANNOTATION_KUBERNETES_AUTH_PROVIDER]: 'serviceAccount',
+        },
+      },
+    ]);
+  });
+
   it('forbids cluster without auth provider', () => {
     const config: Config = new ConfigReader({
       clusters: [{ name: 'cluster', url: 'http://url' }],