kubectl "error: You must be logged in" / Unauthorized in CI
Authentication failed - the API server could not verify who you are. The token is expired, missing, or wrong. This is a 401 (who are you), distinct from a 403 Forbidden (you are known but not allowed).
What this error means
kubectl fails with error: You must be logged in to the server (Unauthorized) or Unauthorized. It often appears in CI when a short-lived token minted earlier in the pipeline has since expired.
error: You must be logged in to the server (Unauthorized)Common causes
Expired or short-lived token
A bound ServiceAccount token, OIDC token, or cloud auth token (EKS/GKE) expired between when it was issued and when kubectl used it. Long jobs are especially prone to this.
Stale or wrong credentials in kubeconfig
The kubeconfig references an old client cert, a rotated token, or the wrong auth provider, so the API server rejects it.
How to fix it
Mint a fresh token right before use
Generate credentials as late as possible so they are valid for the action, especially in long pipelines.
# EKS
aws eks update-kubeconfig --name my-cluster --region us-east-1
# generic short-lived SA token
kubectl create token deployer -n ci --duration=15mVerify authentication, not authorization
- A 401 is auth; a 403 is RBAC - confirm which you have.
- Run
kubectl auth whoami(or any call) to test the credential is accepted. - Check the kubeconfig
users:entry points at the current credential/exec plugin.
How to prevent it
- Generate cluster credentials freshly in CI rather than reusing baked-in tokens.
- Use short-lived tokens minted just before the deploy step.
- Refresh credentials in long jobs before they expire.