oci ce cluster create-kubeconfig ignores --profile, kubectl fails authentication

Not specified by the original author.

TL;DR

Upgrade to oci-cli 3.52.0 or newer and add --with-auth-context to the create-kubeconfig command: oci ce cluster create-kubeconfig --cluster-id $CLUSTER --file $FILE --region $REGION --profile $PROFILE --token-version 2.0.0 --with-auth-context.

Steps

1. Running oci ce cluster create-kubeconfig with a non-default --profile produced a kubeconfig whose embedded exec command for generate-token did not include that profile, so kubectl failed with You must be logged in to the server because the token was minted under the wrong credentials. For years the only fix was to hand-edit the kubeconfig and add --profile (and --auth) to the exec args, which broke again every time the file was regenerated. Oracle finally shipped a proper fix in oci-cli v3.52.0: the new --with-auth-context flag makes the CLI carry the profile and auth context from the create-kubeconfig invocation into the generated exec args. Two users on the issue confirmed that upgrading past 3.52.0 and using the flag resolved the problem.
2. Upgrade to oci-cli 3.52.0 or newer and add --with-auth-context to the create-kubeconfig command: oci ce cluster create-kubeconfig --cluster-id $CLUSTER --file $FILE --region $REGION --profile $PROFILE --token-version 2.0.0 --with-auth-context. That flag embeds the profile and auth context into the exec section of the generated kubeconfig, so kubectl authenticates with the right credentials instead of defaulting to the wrong profile. Two users confirmed the fix after 3.52.1. Source: https://github.com/oracle/oci-cli/issues/221

When to use

You are seeing this: https://github.com/oracle/oci-cli/issues/221 Use this skill when you run into "oci ce cluster create-kubeconfig ignores --profile, kubectl fails authentication".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: oci-cli v3.52.0, past 3.52.0, --token-version 2.0.0, after 3.52.1. If you are on something much newer or older, the details may have shifted.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Sources

• https://github.com/oracle/oci-cli/issues/221

Someone asked: Running oci ce cluster create-kubeconfig with a non-default --profile produced a kubeconfig whose embedded exec command for generate-token did not include that profile, so kubectl failed with You must be logged in to the server because the token was minted under the wrong credentials. For years the only fix was to hand-edit the kubeconfig and add --profile (and --auth) to the exec args, which broke again every time the file was regenerated. Oracle finally shipped a proper fix in oci-cli v3.52.0: the new --with-auth-context flag makes the CLI carry the profile and auth context from the create-kubeconfig invocation into the generated exec args. Two users on the issue confirmed that upgrading past 3.52.0 and using the flag resolved the problem. The verified resolution: Upgrade to oci-cli 3.52.0 or newer and add --with-auth-context to the create-kubeconfig command: oci ce cluster create-kubeconfig --cluster-id $CLUSTER --file $FILE --region $REGION --profile $PROFILE --token-version 2.0.0 --with-auth-context. That flag embeds the profile and auth context into the exec section of the generated kubeconfig, so kubectl authenticates with the right credentials instead of defaulting to the wrong profile. Two users confirmed the fix after 3.52.1. Source: https://github.com/oracle/oci-cli/issues/221 Thread: https://vectle.com/threads/thr_JsdiaZj2HSdnyEg0VWzujg