diff --git a/.changeset/polite-eyes-punch.md b/.changeset/polite-eyes-punch.md
new file mode 100644
index 0000000000..fed1116bb2
--- /dev/null
+++ b/.changeset/polite-eyes-punch.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-kubernetes-backend': patch
+---
+
+add caData support for kubernetes client config
diff --git a/docs/features/kubernetes/configuration.md b/docs/features/kubernetes/configuration.md
index f48faa202d..6b3991144b 100644
--- a/docs/features/kubernetes/configuration.md
+++ b/docs/features/kubernetes/configuration.md
@@ -29,6 +29,7 @@ kubernetes:
           serviceAccountToken: ${K8S_MINIKUBE_TOKEN}
           dashboardUrl: http://127.0.0.1:64713 # url copied from running the command: minikube service kubernetes-dashboard -n kubernetes-dashboard
           dashboardApp: standard
+          caData: ${K8S_CONFIG_CA_DATA}
         - url: http://127.0.0.2:9999
           name: aws-cluster-1
           authProvider: 'aws'
@@ -135,6 +136,24 @@ See also
 https://github.com/backstage/backstage/tree/master/plugins/kubernetes/src/utils/clusterLinks/formatters
 for real examples.
 
+##### `clusters.\*.caData` (optional)
+
+PEM-encoded certificate authority certificates.
+
+This values could be obtained via inspecting the Kubernetes config file (usually
+at `~/.kube/config`) under `clusters.cluster.certificate-authority-data`. For
+GKE, execute the following command to obtain the value
+
+```
+gcloud container clusters describe <YOUR_CLUSTER_NAME> \
+    --zone=<YOUR_COMPUTE_ZONE> \
+    --format="value(masterAuth.clusterCaCertificate)"
+```
+
+See also
+https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication#environments-without-gcloud
+for complete docs about GKE without `gcloud`.
+
 #### `gke`
 
 This cluster locator is designed to work with Kubernetes clusters running in
diff --git a/plugins/kubernetes-backend/api-report.md b/plugins/kubernetes-backend/api-report.md
index c8211a5323..f34815f328 100644
--- a/plugins/kubernetes-backend/api-report.md
+++ b/plugins/kubernetes-backend/api-report.md
@@ -27,6 +27,8 @@ export interface AWSClusterDetails extends ClusterDetails {
 export interface ClusterDetails {
   // (undocumented)
   authProvider: string;
+  // (undocumented)
+  caData?: string | undefined;
   dashboardApp?: string;
   dashboardUrl?: string;
   name: string;
diff --git a/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.test.ts b/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.test.ts
index 6d1506c4c7..62346ac6c3 100644
--- a/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.test.ts
+++ b/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.test.ts
@@ -53,6 +53,7 @@ describe('ConfigClusterLocator', () => {
         url: 'http://localhost:8080',
         authProvider: 'serviceAccount',
         skipTLSVerify: false,
+        caData: undefined,
       },
     ]);
   });
@@ -89,6 +90,7 @@ describe('ConfigClusterLocator', () => {
         url: 'http://localhost:8080',
         authProvider: 'serviceAccount',
         skipTLSVerify: false,
+        caData: undefined,
       },
       {
         name: 'cluster2',
@@ -96,6 +98,7 @@ describe('ConfigClusterLocator', () => {
         url: 'http://localhost:8081',
         authProvider: 'google',
         skipTLSVerify: true,
+        caData: undefined,
       },
     ]);
   });
@@ -141,6 +144,7 @@ describe('ConfigClusterLocator', () => {
         url: 'http://localhost:8080',
         authProvider: 'aws',
         skipTLSVerify: false,
+        caData: undefined,
       },
       {
         assumeRole: 'SomeRole',
@@ -150,6 +154,7 @@ describe('ConfigClusterLocator', () => {
         url: 'http://localhost:8081',
         authProvider: 'aws',
         skipTLSVerify: true,
+        caData: undefined,
       },
       {
         assumeRole: 'SomeRole',
@@ -159,6 +164,7 @@ describe('ConfigClusterLocator', () => {
         serviceAccountToken: undefined,
         authProvider: 'aws',
         skipTLSVerify: true,
+        caData: undefined,
       },
     ]);
   });
diff --git a/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts b/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts
index 53d3a1d025..bb9dbfe13f 100644
--- a/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts
+++ b/plugins/kubernetes-backend/src/cluster-locator/ConfigClusterLocator.ts
@@ -35,6 +35,7 @@ export class ConfigClusterLocator implements KubernetesClustersSupplier {
           url: c.getString('url'),
           serviceAccountToken: c.getOptionalString('serviceAccountToken'),
           skipTLSVerify: c.getOptionalBoolean('skipTLSVerify') ?? false,
+          caData: c.getOptionalString('caData'),
           authProvider: authProvider,
         };
         const dashboardUrl = c.getOptionalString('dashboardUrl');
diff --git a/plugins/kubernetes-backend/src/cluster-locator/GkeClusterLocator.ts b/plugins/kubernetes-backend/src/cluster-locator/GkeClusterLocator.ts
index 7492ca88d3..3aa4a3e941 100644
--- a/plugins/kubernetes-backend/src/cluster-locator/GkeClusterLocator.ts
+++ b/plugins/kubernetes-backend/src/cluster-locator/GkeClusterLocator.ts
@@ -50,6 +50,7 @@ export class GkeClusterLocator implements KubernetesClustersSupplier {
     );
   }
 
+  // TODO pass caData into the object
   async getClusters(): Promise<GKEClusterDetails[]> {
     const { projectId, region, skipTLSVerify } = this.options;
     const request = {
diff --git a/plugins/kubernetes-backend/src/cluster-locator/index.test.ts b/plugins/kubernetes-backend/src/cluster-locator/index.test.ts
index 95be99a8a5..dde4dc1d93 100644
--- a/plugins/kubernetes-backend/src/cluster-locator/index.test.ts
+++ b/plugins/kubernetes-backend/src/cluster-locator/index.test.ts
@@ -54,6 +54,7 @@ describe('getCombinedClusterDetails', () => {
         url: 'http://localhost:8080',
         authProvider: 'serviceAccount',
         skipTLSVerify: false,
+        caData: undefined,
       },
       {
         name: 'cluster2',
@@ -61,6 +62,7 @@ describe('getCombinedClusterDetails', () => {
         url: 'http://localhost:8081',
         authProvider: 'google',
         skipTLSVerify: false,
+        caData: undefined,
       },
     ]);
   });
diff --git a/plugins/kubernetes-backend/src/service/KubernetesClientProvider.ts b/plugins/kubernetes-backend/src/service/KubernetesClientProvider.ts
index 61b19854c2..4b2848508e 100644
--- a/plugins/kubernetes-backend/src/service/KubernetesClientProvider.ts
+++ b/plugins/kubernetes-backend/src/service/KubernetesClientProvider.ts
@@ -31,6 +31,7 @@ export class KubernetesClientProvider {
       name: clusterDetails.name,
       server: clusterDetails.url,
       skipTLSVerify: clusterDetails.skipTLSVerify,
+      caData: clusterDetails.caData,
     };
 
     // TODO configure
diff --git a/plugins/kubernetes-backend/src/types/types.ts b/plugins/kubernetes-backend/src/types/types.ts
index 30a8d2756c..90485fcaee 100644
--- a/plugins/kubernetes-backend/src/types/types.ts
+++ b/plugins/kubernetes-backend/src/types/types.ts
@@ -91,6 +91,7 @@ export interface ClusterDetails {
   authProvider: string;
   serviceAccountToken?: string | undefined;
   skipTLSVerify?: boolean;
+  caData?: string | undefined;
   /**
    * Specifies the link to the Kubernetes dashboard managing this cluster.
    * @remarks