kubernetes/kops · warning

no credentials in cached file

Error message

no credentials in cached file

What it means

A cached ExecCredential whose expiration is still in the future must contain both clientCertificateData and clientKeyData. If either is empty, loadCachedExecCredential returns this error to reject a useless cache entry. As with other cache-load errors, RunKubectlAuthHelper logs it and falls back to buildCredentials.

Source

Thrown at pkg/commands/helpers/kubectl_auth.go:222

		if os.IsNotExist(err) {
			// expected - a cache miss
			return nil, nil
		} else {
			return nil, err
		}
	}

	execCredential := &ExecCredential{}
	if err := json.Unmarshal(b, execCredential); err != nil {
		return nil, fmt.Errorf("error parsing: %v", err)
	}

	if execCredential.Status.ExpirationTimestamp.Before(time.Now()) {
		return nil, nil
	}

	if execCredential.Status.ClientCertificateData == "" || execCredential.Status.ClientKeyData == "" {
		return nil, fmt.Errorf("no credentials in cached file")
	}

	return execCredential, nil
}

func buildCredentials(ctx context.Context, f *util.Factory, options *HelperKubectlAuthOptions) (*ExecCredentialStatus, error) {
	clientset, err := f.KopsClient()
	if err != nil {
		return nil, err
	}

	cluster, err := clientset.GetCluster(ctx, options.ClusterName)
	if err != nil {
		return nil, err
	}

	if cluster == nil {
		return nil, fmt.Errorf("cluster not found %q", options.ClusterName)

View on GitHub (pinned to 4c8573c808)

Solutions

1. Remove the incomplete cache file under ~/.kube/cache/kops-authentication/ and let the helper re-issue credentials.
2. Verify the credential issuance path completes (check klog for 'failed to write cache file' warnings from prior runs).
3. Ensure all nodes/machines use the same kOps version so cache formats match.

When it happens

Trigger: The cache file parses and is not expired but lacks clientCertificateData or clientKeyData — e.g. written by a partially failed run, manually truncated, or created by a different/older helper version with different fields.

Common situations: Interrupted kubectl-auth run that wrote a partial credential; mixing kOps versions whose cache format evolved; hand-crafted cache entries for testing.

Related errors

• DIGITALOCEAN_ACCESS_TOKEN is required
• failed to parse objects: %w
• failed to parse apiVersion %q
• failed to find kind in object
• at least one channel URL is required

AI-assisted analysis of kubernetes/kops@4c8573c808 (2026-09-05). Data as JSON: /api/errors/39bb06011c5b6408. Report an issue: GitHub.