kubectl error: You must be logged in to the server (Unauthorized)

Question

Today I met a strange issue about my Windows kubectl client suddenly raise authorization issue in connecting ICp.

I was using ICP with a Widows configured kubectl.exe. Then, after a while, due to laptop automatic sleeping, my VPN connection was disconnected, hence lose connection to remote ICP. Later I came back and re-connect the ICP. I use kubectl command again and faced:

error: You must be logged in to the server (Unauthorized)

On ICP master node, nothing wrong if I used:

kubectl -s 127.0.0.1:8888 -n kube-system get pods -o wide

I went back to re-configure client (pasted the code copied from admin -> configure kubectl), commands executed successful but when I issue

kubectl get pods

still error.

I checked article:

kubectl - error: You must be logged in to the server

kubectl error: "You must be logged in to the server (the server has asked for the client to provide credentials)"

error: You must be logged in to the server (the server has asked for the client to provide credentials)

It looks like didn't much helpful

Solution

It turns out that the tokens was invalid (not sure if it because of 12 hours expiration). If you simply F5 the browser page you didn't re-authenticated but still can access the console page, but actually the token should be updated by re-login ICP Portal again.

The issue was fixed by re-access the ICP portal:

https://<master host>:8443/console/

This will re-allow you authenticate. After that, go to admin -> configure client, paste the latest commands you will find the token might be updated. Executing the new commands solved the issue.

2 Question still left:

a) If the page was long opened and token expired, ICP portal page may not auto refreshed to force you re-login, that means the token in set-credentials command are still old.

b) Even setting old tokens are accepted and command never complain an error even warning. This may mislead us when token are changed on servers, e.g, If I saved the commands to a local txt file and re-execute it again (even after token expired), the commands still finished successful, but actually I still didn't get authenticated correctly when I try to login.