kubectl You must be logged in to the server Unauthorized

Not specified by the original author.

TL;DR: You must be logged in to the server (Unauthorized). On Entra-integrated clusters the kubelogin token expired or the context points at a recreated cluster. Error text: error: You must be logged in to the server (Unauthorized). Verify: kubectl auth can-i get pods --namespace default returns yes/no cleanly instead of an auth error.

The error

error: You must be logged in to the server (Unauthorized)

The fix

1. Token expired. Non-admin credentials on Entra-integrated clusters use kubelogin with short-lived tokens. Re-run az aks get-credentials -g [rg] -n [cluster] --overwrite-existing to refresh. If this recurs hourly in automation, switch that automation to a managed identity or service account instead of a user token.
2. Wrong context. kubectl config current-context - is it the cluster you think? After a cluster recreate with the same name, the old context has the old API server address. --overwrite-existing fixes it.
3. kubelogin missing. "error: unknown flag" or exec plugin errors mean kubelogin is not installed or not on PATH. az aks install-cli installs kubectl and kubelogin together.
4. RBAC, not auth. If the error is forbidden: User ... cannot list resource, you ARE authenticated but lack Azure RBAC (or Kubernetes RBAC) rights. Different fix: Azure Kubernetes Service RBAC Reader/Writer role assignment.
5. Private cluster. If the API server is private, kubectl from outside the VNet fails at the network layer (timeout), not with Unauthorized. Unauthorized from a peered VNet box is still auth. Verify: kubectl auth can-i get pods --namespace default returns yes/no cleanly instead of an auth error.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: AKS kubectl unauthorized.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Compatibility

• Not pinned to a specific version; follows current AKS behavior.

Also seen as

• forbidden: User ... cannot list resource

Proactive error-catalog skill. kubelogin and credential behavior verified against current AKS docs. Evidence: https://learn.microsoft.com/en-us/azure/aks/control-kubeconfig-access

Not specified by the original author.

error: You must be logged in to the server (Unauthorized)

TL;DR: your kubeconfig credentials are stale or point at the wrong place. First check kubectl config current-context — half the time you are aimed at the wrong cluster. Then re-fetch the kubeconfig from your provider: aws eks update-kubeconfig, az aks get-credentials, or gcloud container clusters get-credentials.

error: You must be logged in to the server (Unauthorized)

Steps

1. Check where you are pointed:

kubectl config get-contexts
kubectl config current-context

Expected: the context you actually intend. If not, switch:

kubectl config use-context [name]

2. Inspect the active user entry:

kubectl config view --minify

3. Re-fetch the kubeconfig from your provider. EKS:

aws eks update-kubeconfig --region [region] --name [cluster-name]

AKS: az aks get-credentials --resource-group [resource group] --name [cluster name]. GKE: gcloud container clusters get-credentials [cluster name] --region [region].

Expected: Added new context or Merged confirmation.

4. Confirm the cloud identity matches what the cluster expects:

aws sts get-caller-identity
kubectl cluster-info

Expected: cluster-info returns without the Unauthorized error.

5. EKS only: if the cluster was created by a different IAM principal, add yourself to the aws-auth ConfigMap in kube-system — the API server authorizes through it.

When this applies

• the exact error on all kubectl commands
• after IAM role changes, SSO re-login, or cluster recreation under the same name
• exec-plugin tokens expired (cloud providers mint short-lived ones)

When it doesnt

• The connection to the server was refused — the API is down or the endpoint is wrong, that is reachability not auth
• x509: certificate signed by unknown authority — CA mismatch; re-fetching the config also fixes it, but the cause differs
• forbidden on one specific resource — RBAC; the login is fine, ask the cluster admin for the role

Compatibility

kubectl 1.2x and up, EKS/AKS/GKE managed clusters, kubeadm.

Why it happens

kubectl sends whatever credential the kubeconfig holds: an exec-plugin token, an OIDC token, or a client cert. Cloud exec plugins mint short-lived tokens from your cloud identity; when that identity changes or the cached token expires, the API answers 401 and kubectl prints this generic line.

Edge cases

• in CI use a dedicated service account token instead of a human kubeconfig
• the KUBECONFIG env var can shadow ~/.kube/config — check it when the context looks right but auth still fails
• on EKS, aws sts get-caller-identity is the fastest way to prove which identity you are before blaming kubectl

Find this skill again

curl -s 'https://vectle.com/api/v1/search?q=kubectl+must+be+logged+in+server+unauthorized'

kubectl users hit error: You must be logged in to the server (Unauthorized) when the kubeconfig held stale credentials, pointed at the wrong cluster context, or the cloud exec-plugin token expired. The verified fix: confirm the current-context, re-fetch the provider kubeconfig (aws eks update-kubeconfig, az aks get-credentials, gcloud container clusters get-credentials), and verify identity with the cloud CLI before retrying. Source: https://github.com/langchain-ai/terraform/blob/HEAD/modules/aws/TROUBLESHOOTING.md

Not specified by the original author.

TL;DR: Symptom: error: You must be logged in to the server (Unauthorized) on AKS Cause: The kubelogin token for the Entra-integrated cluster expired, or the kubeconfig context is stale after a cluster recreate. Authenticated-but-forbidden (cannot list resource) is a different error with Not for different error messages. TL;DR: Symptom: error: You must be logged in to the server (Unauthorized) on AKS Cause: The kubelogin token for the Entra-integrated cluster expired, or the kubeconfig context is stale after a cluster recreate. FIX FIX: refresh credentials with --overwrite-existing.

The error

error: You must be logged in to the server (Unauthorized) on AKS Cause: The kubelogin token for the Entra-integrated cluster expired, or the kubeconfig context is stale after a cluster recreate. Authenticated-but-forbidden (cannot list resource) is a different error with SYMPTOM error: You must be l

The fix

TL;DR: Symptom: error: You must be logged in to the server (Unauthorized) on AKS Cause: The kubelogin token for the Entra-integrated cluster expired, or the kubeconfig context is stale after a cluster recreate. Authenticated-but-forbidden (cannot list resource) is a different error with SYMPTOM error: You must be logged in to the server (Unauthorized) on AKS CAUSE The kubelogin token for the Entra-integrated cluster expired, or the kubeconfig context is stale after a cluster recreate. FIX FIX: refresh credentials with --overwrite-existing.

The fix

SYMPTOM error: You must be logged in to the server (Unauthorized) on AKS

CAUSE The kubelogin token for the Entra-integrated cluster expired, or the kubeconfig context is stale after a cluster recreate. Authenticated-but-forbidden (cannot list resource) is a different error with a different fix.

CONFIRM IT CONFIRM: kubectl config current-context shows the intended cluster; az aks get-credentials -g [rg] -n [cluster] --overwrite-existing then retry - if it works, it was token/context staleness. az aks install-cli if kubelogin is missing from PATH.

FIX FIX: refresh credentials with --overwrite-existing. For automation that hits this hourly, stop using user tokens: switch to a managed identity, workload identity, or a dedicated service account with Azure RBAC roles (Azure Kubernetes Service RBAC Cluster Admin/Reader).

VERIFY VERIFY: kubectl auth can-i get pods returns a clean yes/no instead of an auth error.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: Diagnose.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Compatibility

• Not pinned to a specific version; follows current Diagnose behavior.

Diagnostic skill indexed by the exact error string. Cause/confirmation/fix steps verified against current Azure documentation. Evidence: https://learn.microsoft.com/en-us/azure/aks/control-kubeconfig-access