diff --git a/pkg/provider/kubernetes/auth.go b/pkg/provider/kubernetes/auth.go
index d62b23cd1..8d7eeaf66 100644
--- a/pkg/provider/kubernetes/auth.go
+++ b/pkg/provider/kubernetes/auth.go
@@ -44,6 +44,14 @@ func (c *Client) getAuth(ctx context.Context) (*rest.Config, error) {
 		return clientcmd.RESTConfigFromKubeConfig(cfg)
 	}
 
+	if c.store.Server.URL == "" {
+		return nil, errors.New("no server URL provided")
+	}
+
+	cfg := &rest.Config{
+		Host: c.store.Server.URL,
+	}
+
 	ca, err := utils.FetchCACertFromSource(ctx, utils.CreateCertOpts{
 		CABundle:   c.store.Server.CABundle,
 		CAProvider: c.store.Server.CAProvider,
@@ -55,43 +63,39 @@ func (c *Client) getAuth(ctx context.Context) (*rest.Config, error) {
 		return nil, err
 	}
 
-	var token []byte
-	if c.store.Auth.Token != nil {
-		token, err = c.fetchSecretKey(ctx, c.store.Auth.Token.BearerToken)
+	cfg.TLSClientConfig = rest.TLSClientConfig{
+		Insecure: false,
+		CAData:   ca,
+	}
+
+	switch {
+	case c.store.Auth.Token != nil:
+		token, err := c.fetchSecretKey(ctx, c.store.Auth.Token.BearerToken)
 		if err != nil {
 			return nil, fmt.Errorf("could not fetch Auth.Token.BearerToken: %w", err)
 		}
-	} else if c.store.Auth.ServiceAccount != nil {
-		token, err = c.serviceAccountToken(ctx, c.store.Auth.ServiceAccount)
+
+		cfg.BearerToken = string(token)
+	case c.store.Auth.ServiceAccount != nil:
+		token, err := c.serviceAccountToken(ctx, c.store.Auth.ServiceAccount)
 		if err != nil {
 			return nil, fmt.Errorf("could not fetch Auth.ServiceAccount: %w", err)
 		}
-	} else {
-		return nil, errors.New("no auth provider given")
-	}
 
-	var key, cert []byte
-	if c.store.Auth.Cert != nil {
-		key, cert, err = c.getClientKeyAndCert(ctx)
+		cfg.BearerToken = string(token)
+	case c.store.Auth.Cert != nil:
+		key, cert, err := c.getClientKeyAndCert(ctx)
 		if err != nil {
 			return nil, fmt.Errorf("could not fetch client key and cert: %w", err)
 		}
+
+		cfg.TLSClientConfig.KeyData = key
+		cfg.TLSClientConfig.CertData = cert
+	default:
+		return nil, errors.New("no auth provider given")
 	}
 
-	if c.store.Server.URL == "" {
-		return nil, errors.New("no server URL provided")
-	}
-
-	return &rest.Config{
-		Host:        c.store.Server.URL,
-		BearerToken: string(token),
-		TLSClientConfig: rest.TLSClientConfig{
-			Insecure: false,
-			CertData: cert,
-			KeyData:  key,
-			CAData:   ca,
-		},
-	}, nil
+	return cfg, nil
 }
 
 func (c *Client) getClientKeyAndCert(ctx context.Context) ([]byte, []byte, error) {
diff --git a/pkg/provider/kubernetes/auth_test.go b/pkg/provider/kubernetes/auth_test.go
index 84e2a0d75..7c3feb75c 100644
--- a/pkg/provider/kubernetes/auth_test.go
+++ b/pkg/provider/kubernetes/auth_test.go
@@ -250,14 +250,6 @@ func TestSetAuth(t *testing.T) {
 						"cert": []byte("my-cert"),
 						"key":  []byte("my-key"),
 					},
-				}, &corev1.Secret{
-					ObjectMeta: metav1.ObjectMeta{
-						Name:      "foobar",
-						Namespace: "default",
-					},
-					Data: map[string][]byte{
-						"token": []byte("mytoken"),
-					},
 				}).Build(),
 				store: &esv1beta1.KubernetesProvider{
 					Server: esv1beta1.KubernetesServer{
@@ -265,13 +257,6 @@ func TestSetAuth(t *testing.T) {
 						CABundle: []byte(caCert),
 					},
 					Auth: esv1beta1.KubernetesAuth{
-						Token: &esv1beta1.TokenAuth{
-							BearerToken: v1.SecretKeySelector{
-								Name:      "foobar",
-								Namespace: pointer.To("shouldnotberelevant"),
-								Key:       "token",
-							},
-						},
 						Cert: &esv1beta1.CertAuth{
 							ClientCert: v1.SecretKeySelector{
 								Name: "mycert",
@@ -286,8 +271,7 @@ func TestSetAuth(t *testing.T) {
 				},
 			},
 			want: &want{
-				Host:        "https://my.test.tld",
-				BearerToken: "mytoken",
+				Host: "https://my.test.tld",
 				TLSClientConfig: rest.TLSClientConfig{
 					CAData:   []byte(caCert),
 					CertData: []byte("my-cert"),