AKS "az aks get-credentials ... kubelogin not found" in CI

By Kaveh Alemi·Latchkey

AKS clusters with Entra ID integration use kubelogin as a client-go exec plugin so kubectl can obtain Entra tokens. If kubelogin is not on the runner, kubectl cannot authenticate after get-credentials.

What this error means

kubectl against AKS fails with "Unable to connect to the server: getting credentials: exec: executable kubelogin not found", even though az aks get-credentials succeeded.

Unable to connect to the server: getting credentials: exec: executable kubelogin
not found

It looks like you are trying to use a client-go credential plugin that is not installed.

Common causes

kubelogin is not installed on the runner

The kubeconfig from an Entra-integrated cluster references kubelogin, which the runner image does not include by default.

The kubeconfig uses a mode that requires conversion

Without converting the kubeconfig to a non-interactive login mode, kubectl tries to prompt, which cannot work in CI.

How to fix it

Install kubelogin and convert the kubeconfig

1. Install kubelogin on the runner.
2. Get credentials, then convert the kubeconfig to a non-interactive service principal or workload identity mode.
3. Run kubectl.

az aks install-cli
az aks get-credentials --resource-group rg --name my-aks
kubelogin convert-kubeconfig -l spn

Use the azure/aks-set-context action

The official action installs kubelogin and sets a non-interactive context for CI.

- uses: azure/aks-set-context@v4
  with:
    resource-group: rg
    cluster-name: my-aks

How to prevent it

• Install kubelogin in the runner image for Entra-integrated clusters.
• Convert the kubeconfig to a non-interactive login mode in CI.
• Prefer the official aks-set-context action which handles both.

Frequently asked questions

Related guides

References

• Terraform documentation
• GitHub Actions documentation