[keycloak-user] Kubernetes integration

Question regarding using KeyCloak and Kubernetes. Kubernetes only supports one ClientID. If you are supporting both the cli and the web ui, in Dex or Google you setup two clients, one for the website, and one for the cli. you mark the cli a Public Client, and you establish a trust between the website client and the cli. In either case then, the token passed to Kubernetes is for the same client. What is the recommended way of doing something like this with KeyCloak? I see a Public Client option, but I don't see a way to establish the trust between clients. Thanks, Kevin