{"record":{"id":"82c94fe56ae2071c","repo":"argoproj/argo-workflows","slug":"invalid-expiry-date-in-kubeconfig-w","errorCode":null,"errorMessage":"invalid expiry date in Kubeconfig. %w","messagePattern":"invalid expiry date in Kubeconfig\\. %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"util/kubeconfig/kubeconfig.go","lineNumber":284,"sourceCode":"\t}\n\treturn before, after, true\n}\n\nfunc ReloadKubeConfig(explicitPath string) clientcmd.ClientConfig {\n\tloadingRules := clientcmd.NewDefaultClientConfigLoadingRules()\n\tloadingRules.DefaultClientConfig = &clientcmd.DefaultClientConfig\n\tloadingRules.ExplicitPath = explicitPath\n\toverrides := clientcmd.ConfigOverrides{}\n\treturn clientcmd.NewInteractiveDeferredLoadingClientConfig(loadingRules, &overrides, os.Stdin)\n}\n\nfunc RefreshTokenIfExpired(restConfig *restclient.Config, explicitPath, curentToken string) (string, error) {\n\tif restConfig.AuthProvider != nil {\n\t\ttimestr := restConfig.AuthProvider.Config[\"expiry\"]\n\t\tif timestr != \"\" {\n\t\t\tt, err := time.Parse(time.RFC3339, timestr)\n\t\t\tif err != nil {\n\t\t\t\treturn \"\", fmt.Errorf(\"invalid expiry date in Kubeconfig. %w\", err)\n\t\t\t}\n\t\t\tif time.Now().After(t) {\n\t\t\t\terr = RefreshAuthToken(restConfig)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn \"\", err\n\t\t\t\t}\n\t\t\t\tconfig := ReloadKubeConfig(explicitPath)\n\t\t\t\trestConfig, err = config.ClientConfig()\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn \"\", err\n\t\t\t\t}\n\t\t\t\treturn restConfig.AuthProvider.Config[\"access-token\"], nil\n\t\t\t}\n\t\t}\n\t}\n\treturn curentToken, nil\n}\n","sourceCodeStart":266,"sourceCodeEnd":302,"githubUrl":"https://github.com/argoproj/argo-workflows/blob/35bff19146f5a6ada77468c431f2624bd577e373/util/kubeconfig/kubeconfig.go#L266-L302","documentation":"RefreshTokenIfExpired reads the 'expiry' field from the kubeconfig auth-provider config and parses it strictly as RFC3339. If the timestamp cannot be parsed, GetBearerToken cannot proceed because it cannot decide whether the token needs refreshing, so it fails with this wrapped error.","triggerScenarios":"A kubeconfig whose auth-provider entry has an 'expiry' value not in RFC3339 format (e.g. '2024-05-01 12:00:00', epoch seconds '1714521600', or a locale-formatted date), used when obtaining a bearer token for a delegated kube workflow.","commonSituations":"Hand-edited kubeconfigs; cloud auth plugins (gke/oidc/azure) writing non-RFC3339 expiry values or an Argo version parsing a format the provider changed; expired or malformed kubeconfig copied from another machine.","solutions":["Fix the kubeconfig 'expiry' value to strict RFC3339 (e.g. 2026-09-03T12:00:00Z) with no space separator and a timezone.","Regenerate credentials with the provider's login tool (e.g. gcloud auth login / kubectl oidc-login) so it rewrites a valid expiry.","Remove the stale auth-provider block and switch to a token/exec-based credential that does not carry an expiry field.","Use an explicit kubeconfig path (explicitPath) pointing to a known-good file via `argo auth kubeconfig`."],"exampleFix":"# before\napiVersion: v1\nusers:\n- name: me\n  user:\n    auth-provider:\n      config:\n        expiry: \"2026-09-03 12:00:00\"\n# after\n        expiry: \"2026-09-03T12:00:00Z\"","handlingStrategy":"validation","validationCode":"func expiryIsValid(kcfg string) error {\n    cfg, err := clientcmd.LoadFromFile(kcfg)\n    if err != nil { return err }\n    for _, u := range cfg.AuthInfos {\n        if ap := u.AuthProvider; ap != nil {\n            if t := ap.Config[\"expiry\"]; t != \"\" {\n                if _, err := time.Parse(time.RFC3339, t); err != nil {\n                    return fmt.Errorf(\"user %q expiry %q is not RFC3339\", u.Name, t)\n                }\n            }\n        }\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"token, err := kubeconfig.RefreshTokenIfExpired(restConfig, path, token)\nif err != nil && strings.Contains(err.Error(), \"invalid expiry date\") {\n    // prompt re-login / regenerate kubeconfig before retrying\n    return fmt.Errorf(\"kubeconfig auth-provider expiry malformed; rerun provider login: %w\", err)\n}","preventionTips":["Never hand-edit the auth-provider expiry; let the cloud provider's login tool write it.","Validate kubeconfigs (RFC3339 expiry) before deploying them into pods.","Prefer exec-based or static-token credentials over auth-provider blocks where possible.","After tool upgrades, re-login once so the expiry format matches what the provider now emits."],"tags":["go","kubeconfig","authentication","config"],"backgroundTag":"kubeconfig-invalid-expiry","analyzedSha":"35bff19146f5a6ada77468c431f2624bd577e373","analyzedAt":"2026-09-03T19:34:35.908Z","contentChangedAt":"2026-09-03T19:34:35.908Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}