{"record":{"id":"39bb06011c5b6408","repo":"kubernetes/kops","slug":"no-credentials-in-cached-file","errorCode":null,"errorMessage":"no credentials in cached file","messagePattern":"no credentials in cached file","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/commands/helpers/kubectl_auth.go","lineNumber":222,"sourceCode":"\t\tif os.IsNotExist(err) {\n\t\t\t// expected - a cache miss\n\t\t\treturn nil, nil\n\t\t} else {\n\t\t\treturn nil, err\n\t\t}\n\t}\n\n\texecCredential := &ExecCredential{}\n\tif err := json.Unmarshal(b, execCredential); err != nil {\n\t\treturn nil, fmt.Errorf(\"error parsing: %v\", err)\n\t}\n\n\tif execCredential.Status.ExpirationTimestamp.Before(time.Now()) {\n\t\treturn nil, nil\n\t}\n\n\tif execCredential.Status.ClientCertificateData == \"\" || execCredential.Status.ClientKeyData == \"\" {\n\t\treturn nil, fmt.Errorf(\"no credentials in cached file\")\n\t}\n\n\treturn execCredential, nil\n}\n\nfunc buildCredentials(ctx context.Context, f *util.Factory, options *HelperKubectlAuthOptions) (*ExecCredentialStatus, error) {\n\tclientset, err := f.KopsClient()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tcluster, err := clientset.GetCluster(ctx, options.ClusterName)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif cluster == nil {\n\t\treturn nil, fmt.Errorf(\"cluster not found %q\", options.ClusterName)","sourceCodeStart":204,"sourceCodeEnd":240,"githubUrl":"https://github.com/kubernetes/kops/blob/4c8573c808a73d578c5eadc86d410646ea0b0d73/pkg/commands/helpers/kubectl_auth.go#L204-L240","documentation":"A cached ExecCredential whose expiration is still in the future must contain both clientCertificateData and clientKeyData. If either is empty, loadCachedExecCredential returns this error to reject a useless cache entry. As with other cache-load errors, RunKubectlAuthHelper logs it and falls back to buildCredentials.","triggerScenarios":"The cache file parses and is not expired but lacks clientCertificateData or clientKeyData — e.g. written by a partially failed run, manually truncated, or created by a different/older helper version with different fields.","commonSituations":"Interrupted kubectl-auth run that wrote a partial credential; mixing kOps versions whose cache format evolved; hand-crafted cache entries for testing.","solutions":["Remove the incomplete cache file under ~/.kube/cache/kops-authentication/ and let the helper re-issue credentials.","Verify the credential issuance path completes (check klog for 'failed to write cache file' warnings from prior runs).","Ensure all nodes/machines use the same kOps version so cache formats match."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":["Delete incomplete cache entries; the helper re-issues credentials automatically on this error.","Ensure prior runs complete successfully (check for 'failed to write cache file' warnings).","Keep kOps versions consistent across environments."],"tags":["cache","credentials","validation"],"backgroundTag":"invalid-cached-credentials","analyzedSha":"4c8573c808a73d578c5eadc86d410646ea0b0d73","analyzedAt":"2026-09-05T04:13:19.212Z","contentChangedAt":"2026-09-05T04:13:19.212Z","schemaVersion":2},"datasetVersion":"2026-09-12T12:17:11.808Z"}