help-wanted: `ce cluster generate-token` shows an interactive re-auth prompt when the session token is expired, breaking kubectl exec credential plugin usage
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 669
- Forks
- 236
- Avg merge
- 1m
- Merged PRs (30d)
- 4
Description
Summary
When oci ce cluster generate-token is configured as a kubectl exec credential
plugin (the default kubeconfig generated by oci ce cluster create-kubeconfig
with --auth security_token), and the CLI session token has expired, the CLI
prints an interactive prompt:
ERROR: This CLI session has expired, so it cannot currently be used to run commands
Do you want to re-authenticate your CLI session profile? [Y/n]:
kubectl invokes the plugin without a TTY, so the prompt cannot be answered and
the command exits non-zero. All the user sees from kubectl is:
Unable to connect to the server: getting credentials: exec: executable oci failed with exit code 1
The real cause (expired session) is completely hidden, which makes this very
hard to diagnose — every kubectl command just appears broken.
Steps to reproduce
oci session authenticate --profile-name <profile> --region <region>oci ce cluster create-kubeconfig --cluster-id <ocid> --auth security_token --profile <profile> ...- Use kubectl normally until the session token expires (~1 hour)
- Run any kubectl command, e.g.
kubectl get nodes
Actual behavior
Interactive [Y/n] prompt that cannot be answered in the exec-plugin context;
opaque exit code 1 from kubectl's perspective.
Environment
- OCI CLI version: 3.90.1
- Python: 3.14.6
- OS: macOS 27.0 (arm64)
- kubectl client: v1.36.3
- Auth:
--auth security_token(session created viaoci session authenticate)
Workaround
Manually run oci session authenticate --profile-name <profile> (or
oci session refresh) whenever kubectl starts failing with
"executable oci failed with exit code 1".
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing oci ce cluster generate-token after the session token expires, both directly and as a kubectl exec credential plugin without a TTY. Trace the session-expiration handling and verify that kubectl no longer hides the expired-session cause behind an unanswered interactive prompt.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication, cli, cloud
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 68/100