exec plugin failed: The credential plugin named in the kubeconfig did not produce a token

Managed clusters authenticate by running an external command that returns a token. When that command fails or is missing, kubectl cannot authenticate at all — and the error names the command, not the cluster.

Applies to: All Kubernetes versions using exec credential plugins

What it means

A kubeconfig can specify an exec credential plugin: kubectl runs a command, and the command returns a short-lived token in a defined JSON format. Every major managed Kubernetes platform uses this. When it fails, kubectl reports that the exec plugin failed, and the cause is almost always outside Kubernetes entirely — the CLI tool is not installed or not on PATH, the cloud session has expired, or the plugin's API version in the kubeconfig is older than the installed tool supports. That last case is the one that produces a working setup breaking after an unrelated tool upgrade.

Most common causes

• The plugin binary is not installed or not on PATH.
• The cloud provider session or login has expired.
• The apiVersion of the exec plugin in the kubeconfig is no longer supported by the installed tool.
• The plugin requires interactive input in a non-interactive context such as CI.
• Environment variables the plugin needs — a profile, a project, a region — are not set.
• A version mismatch between kubectl and the plugin's expected protocol.

How to diagnose it

1. Read the kubeconfig's exec block: kubectl config view --minify -o jsonpath='{.users[0].user.exec}'.
2. Run the plugin command manually with the same arguments and see what it outputs.
3. Check the binary is on PATH: command -v PLUGIN.
4. Check the cloud session is valid using the provider's own status command.
5. Compare the exec apiVersion in the kubeconfig against what the installed plugin supports.
6. In CI, check that credentials are available non-interactively.

How to fix it

1. Install the plugin binary and ensure it is on PATH for the user running kubectl.
2. Re-authenticate with the cloud provider.
3. Regenerate the kubeconfig with the provider's current command, which writes a compatible exec apiVersion.
4. Set the environment variables the plugin needs, in CI as well as locally.
5. Use a static token or certificate for automation if a plugin requiring interactivity is not viable there.

Notes

Because the token is fetched per invocation, this failure appears suddenly on a setup that worked minutes earlier — the session simply expired. Checking session validity before anything else usually resolves it in one step.

Related

• Unauthorized — The request was not authenticated
• current-context is not set — A kubeconfig exists but selects no cluster

Sources

• Kubernetes documentation — Authenticating: client-go credential plugins
• Kubernetes documentation — Organizing Cluster Access Using kubeconfig Files
• Kubernetes documentation — kubectl config