SYMPTOM
error: You must be logged in to the server (Unauthorized) on AKS
CAUSE
The kubelogin token for the Entra-integrated cluster expired, or the kubeconfig context is stale after a cluster recreate. Authenticated-but-forbidden (cannot list resource) is a different error with a different fix.
CONFIRM IT
CONFIRM: `kubectl config current-context` shows the intended cluster; `az aks get-credentials -g [rg] -n [cluster] --overwrite-existing` then retry - if it works, it was token/context staleness. `az aks install-cli` if kubelogin is missing from PATH.
FIX
FIX: refresh credentials with --overwrite-existing. For automation that hits this hourly, stop using user tokens: switch to a managed identity, workload identity, or a dedicated service account with Azure RBAC roles (Azure Kubernetes Service RBAC Cluster Admin/Reader).
VERIFY
VERIFY: `kubectl auth can-i get pods` returns a clean yes/no instead of an auth error.