kubernetes/kops · error

could not find user %q

Error message

could not find user %q

What it means

WriteKubecfg builds a kubeconfig and, when the builder's User field is set but KubeUser/ClientCert paths are not taken, requires that the user entry already exist in the existing kubeconfig AuthInfos map. If no AuthInfo named b.User is present in the config being modified, this error is returned and the kubeconfig is not written. It protects against writing a context that references a dangling user credential.

Source

Thrown at pkg/kubeconfig/kubecfg_builder.go:156

		if usingAuthPlugin {
			authInfo.Exec = &clientcmdapi.ExecConfig{
				APIVersion: "client.authentication.k8s.io/v1beta1",
				Command:    b.AuthenticationExec[0],
				Args:       b.AuthenticationExec[1:],
			}

			haveUserInfo = true
		}

		if haveUserInfo {
			if config.AuthInfos == nil {
				config.AuthInfos = make(map[string]*clientcmdapi.AuthInfo)
			}
			config.AuthInfos[b.Context] = authInfo
		}
	} else if b.User != "" {
		if config.AuthInfos[b.User] == nil {
			return fmt.Errorf("could not find user %q", b.User)
		}
		haveUserInfo = true
	}

	// If we have a bearer token, also create a credential entry with basic auth
	// so that it is easy to discover the basic auth password for your cluster
	// to use in a web browser.
	if b.KubeUser != "" && b.KubePassword != "" {
		name := b.Context + "-basic-auth"
		authInfo := config.AuthInfos[name]
		if authInfo == nil {
			authInfo = clientcmdapi.NewAuthInfo()
		}

		authInfo.Username = b.KubeUser
		authInfo.Password = b.KubePassword

		if config.AuthInfos == nil {

View on GitHub (pinned to 4c8573c808)

Solutions

1. Regenerate the user entry (e.g. `kops export kubecfg --name <cluster>`), which re-creates the AuthInfo
2. Check `kubectl config get-users` and ensure the user named in the error exists in the file referenced by $KUBECONFIG
3. Create the user manually with `kubectl config set-credentials <user> ...` before retrying
4. Verify KUBECONFIG env var points at the intended kubeconfig file

Example fix

// before (stale kubeconfig, user 'admin.mycluster' missing)
builder.User = "admin.mycluster"
err := builder.WriteKubecfg(configAccess)
// after: re-export so the user entry is recreated
// kops export kubecfg --name mycluster.k8s.local

func userExists(kubeconfigPath, user string) (bool, error) {
	cfg, err := clientcmd.LoadFromFile(kubeconfigPath)
	if err != nil { return false, err }
	_, ok := cfg.AuthInfos[user]
	return ok, nil
}

if err := builder.WriteKubecfg(access); err != nil {
	if strings.Contains(err.Error(), "could not find user") {
		// regenerate credentials: kops export kubecfg --name <cluster>
		return regenerateKubecfg(clusterName)
	}
	return err
}

When it happens

Trigger: Calling WriteKubecfg with KubeconfigBuilder.User set to a name that does not exist in the current kubeconfig's auth-infos, while KubeUser/KubePassword and ClientCert/ClientKey are empty so the inline-credential branch is skipped.

Common situations: Running `kops export kubecfg`/`update kubecfg` against a cluster whose admin user entry was deleted or renamed in ~/.kube/config; stale KUBECONFIG pointing at a config without the expected user; typo'd user name.

Related errors

• getting rest config: %w
• unmarshalling authorization token data: %w
• incorrect Audience
• incorrect Timestamp %v
• incorrect RequestHash

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/000b07d57b0a8d81. Report an issue: GitHub.