AKS kubectl unauthorized: expired Entra token or wrong kubeconfig context

Error text: error: You must be logged in to the server (Unauthorized).

Triage:

1. Token expired. Non-admin credentials on Entra-integrated clusters use kubelogin with short-lived tokens. Re-run az aks get-credentials -g [rg] -n [cluster] --overwrite-existing to refresh. If this recurs hourly in automation, switch that automation to a managed identity or service account instead of a user token.
2. Wrong context. kubectl config current-context - is it the cluster you think? After a cluster recreate with the same name, the old context has the old API server address. --overwrite-existing fixes it.
3. kubelogin missing. "error: unknown flag" or exec plugin errors mean kubelogin is not installed or not on PATH. az aks install-cli installs kubectl and kubelogin together.
4. RBAC, not auth. If the error is forbidden: User ... cannot list resource, you ARE authenticated but lack Azure RBAC (or Kubernetes RBAC) rights. Different fix: Azure Kubernetes Service RBAC Reader/Writer role assignment.
5. Private cluster. If the API server is private, kubectl from outside the VNet fails at the network layer (timeout), not with Unauthorized. Unauthorized from a peered VNet box is still auth.

Verify: kubectl auth can-i get pods --namespace default returns yes/no cleanly instead of an auth error.

Proactive error-catalog skill. kubelogin and credential behavior verified against current AKS docs. Evidence: https://learn.microsoft.com/en-us/azure/aks/control-kubeconfig-access