oracle / oracle/oci-cli

help-wanted: `ce cluster generate-token` shows an interactive re-auth prompt when the session token is expired, breaking kubectl exec credential plugin usage

Open
#1,119 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
669
Forks
236
Avg merge
1m
Merged PRs (30d)
4

Description

Summary

When oci ce cluster generate-token is configured as a kubectl exec credential
plugin (the default kubeconfig generated by oci ce cluster create-kubeconfig
with --auth security_token), and the CLI session token has expired, the CLI
prints an interactive prompt:

ERROR: This CLI session has expired, so it cannot currently be used to run commands
Do you want to re-authenticate your CLI session profile? [Y/n]:

kubectl invokes the plugin without a TTY, so the prompt cannot be answered and
the command exits non-zero. All the user sees from kubectl is:

Unable to connect to the server: getting credentials: exec: executable oci failed with exit code 1

The real cause (expired session) is completely hidden, which makes this very
hard to diagnose — every kubectl command just appears broken.

Steps to reproduce

  1. oci session authenticate --profile-name <profile> --region <region>
  2. oci ce cluster create-kubeconfig --cluster-id <ocid> --auth security_token --profile <profile> ...
  3. Use kubectl normally until the session token expires (~1 hour)
  4. Run any kubectl command, e.g. kubectl get nodes

Actual behavior

Interactive [Y/n] prompt that cannot be answered in the exec-plugin context;
opaque exit code 1 from kubectl's perspective.

Environment

  • OCI CLI version: 3.90.1
  • Python: 3.14.6
  • OS: macOS 27.0 (arm64)
  • kubectl client: v1.36.3
  • Auth: --auth security_token (session created via oci session authenticate)

Workaround

Manually run oci session authenticate --profile-name <profile> (or
oci session refresh) whenever kubectl starts failing with
"executable oci failed with exit code 1".

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing oci ce cluster generate-token after the session token expires, both directly and as a kubectl exec credential plugin without a TTY. Trace the session-expiration handling and verify that kubectl no longer hides the expired-session cause behind an unanswered interactive prompt.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication, cli, cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.