oci ce cluster create-kubeconfig ignores --profile, kubectl fails authentication

Not specified by the original author.

oci ce cluster create-kubeconfig ignores --profile, kubectl fails authentication

What was going on

Running oci ce cluster create-kubeconfig with a non-default --profile produced a kubeconfig whose embedded exec command for generate-token did not include that profile, so kubectl failed with You must be logged in to the server because the token was minted under the wrong credentials. For years the only fix was to hand-edit the kubeconfig and add --profile (and --auth) to the exec args, which broke again every time the file was regenerated. Oracle finally shipped a proper fix in oci-cli v3.52.0: the new --with-auth-context flag makes the CLI carry the profile and auth context from the create-kubeconfig invocation into the generated exec args. Two users on the issue confirmed that upgrading past 3.52.0 and using the flag resolved the problem.

The fix that worked

Upgrade to oci-cli 3.52.0 or newer and add --with-auth-context to the create-kubeconfig command: oci ce cluster create-kubeconfig --cluster-id $CLUSTER --file $FILE --region $REGION --profile $PROFILE --token-version 2.0.0 --with-auth-context. That flag embeds the profile and auth context into the exec section of the generated kubeconfig, so kubectl authenticates with the right credentials instead of defaulting to the wrong profile. Two users confirmed the fix after 3.52.1. Source: https://github.com/oracle/oci-cli/issues/221

Where this came from

https://github.com/oracle/oci-cli/issues/221

Someone asked: Running oci ce cluster create-kubeconfig with a non-default --profile produced a kubeconfig whose embedded exec command for generate-token did not include that profile, so kubectl failed with You must be logged in to the server because the token was minted under the wrong credentials. For years the only fix was to hand-edit the kubeconfig and add --profile (and --auth) to the exec args, which broke again every time the file was regenerated. Oracle finally shipped a proper fix in oci-cli v3.52.0: the new --with-auth-context flag makes the CLI carry the profile and auth context from the create-kubeconfig invocation into the generated exec args. Two users on the issue confirmed that upgrading past 3.52.0 and using the flag resolved the problem. The verified resolution: Upgrade to oci-cli 3.52.0 or newer and add --with-auth-context to the create-kubeconfig command: oci ce cluster create-kubeconfig --cluster-id $CLUSTER --file $FILE --region $REGION --profile $PROFILE --token-version 2.0.0 --with-auth-context. That flag embeds the profile and auth context into the exec section of the generated kubeconfig, so kubectl authenticates with the right credentials instead of defaulting to the wrong profile. Two users confirmed the fix after 3.52.1. Source: https://github.com/oracle/oci-cli/issues/221 Thread: https://vectle.com/threads/thr_JsdiaZj2HSdnyEg0VWzujg