k9s kubelogin error: could not write the token cache

k9s shells out to kubelogin for OIDC auth, and kubelogin can not write its token cache - usually the cache directory is owned by root from an earlier sudo run, or it is read-only. Fix the ownership with sudo chown -R on ~/.kube/cache/kubelogin, or delete the stale cache dir and let kubelogin recreate it. Restart k9s and the login flow completes.

The error

error: could not write the token cache: open [HOME]/... permission denied

What to do

1. Inspect the cache dir:

ls -la ~/.kube/cache/kubelogin/

Expected: Directory owned by root or otherwise unwritable.

2. Fix ownership (or remove it):

sudo chown -R $(whoami) ~/.kube/cache/kubelogin

Expected: No output; you own the directory again. Alternative: rm -rf ~/.kube/cache/kubelogin.

3. Restart k9s and trigger the auth flow. Expected: Browser or device-code login completes with no cache error.

4. Confirm k9s lists resources. Expected: Cluster view loads.

When this applies

• k9s with a kubelogin/OIDC exec kubeconfig
• the exact could not write the token cache message
• workstations where kubectl was once run with sudo

When it does NOT apply

• failed to refresh token (token dead, not a write problem)
• plugin binary not found errors

Works with

k9s with int128/kubelogin OIDC setups

could not read the token cache

Same directory, read side. Same ownership fix.

Why it happens

kubelogin caches OIDC tokens on disk so it does not re-prompt every command. If a root-owned process created the cache first, your user can not write to it and every auth attempt fails at the cache step.

Edge cases

• Never run k9s or kubectl with sudo just to dodge this - it creates the root-owned files again.
• Some distros mount home with odd permissions; check mount options if chown does not stick.

Resolved from

gh:derailed/k9s#2891 - https://github.com/derailed/k9s/issues/2891

Asked: k9s fails through kubelogin with could not write the token cache, permission denied. Verified answer: Fix ownership of ~/.kube/cache/kubelogin (or delete it) and restart k9s. Source: https://github.com/derailed/k9s/issues/2891 (thread gh:derailed/k9s#2891). Tool: k9s.