AKS AAD enabled kubectl: error: You must be logged in to the server (Unauthorized)

Question

AKS AAD enabled kubectl: error: You must be logged in to the server (Unauthorized)

Tomasz Sleboda 6

I have AKS cluster (1.18.17) with aad enabled and since couple of days I get following error from kubectl

error: You must be logged in to the server (Unauthorized)

az login
az account set --subscription

SRIJIT-BOSE-MSFT 4,346 Reputation points Microsoft Employee

2021-07-20T12:54:10.573+00:00

@Tomasz Sleboda , Thank you for your question.

Can you please reset the AAD Application credentials as described here and check if this helps?
Tomasz Sleboda 6 Reputation points

2021-07-21T21:35:47.977+00:00

unfortunately,

Operation failed with status: 'Bad Request'. Details: Operation 'resetAADProfile' is not allowed for managed AAD enabled cluster.
SRIJIT-BOSE-MSFT 4,346 Reputation points Microsoft Employee

2021-07-22T06:59:30.163+00:00

@Tomasz Sleboda , Thank you for your response. We are checking this internally. We'll reach out to you as we have more information.
SRIJIT-BOSE-MSFT 4,346 Reputation points Microsoft Employee

2021-07-22T17:12:40.017+00:00

@Tomasz Sleboda , can you please check and rotate cluster certificates if invalidated? [How-to guide]
Tomasz Sleboda 6 Reputation points

2021-07-25T19:56:49.893+00:00

@SRIJIT-BOSE-MSFT , I've just checked certificates and they seem to be ok:
a) curl https://{apiserver-fqdn} -k -v 2>&1 |grep expire
* expire date: Jun 16 21:40:45 2023 GMT
b) az vm run-command invoke -g MC_rg_myAKSCluster_region -n vm-name --command-id RunShellScript --query 'value[0].message' -otsv --scripts "openssl x509 -in /etc/kubernetes/certs/apiserver.crt -noout -enddate"
Enable succeeded:
[stdout]
notAfter=Jun 16 21:40:45 2023 GMT

[stderr]
c) kubectl config view --raw -o jsonpath="{.users[?(@.name == 'clusterUser_rg_myAKSCluster')].user.client-certificate-data}" | base64 -d | openssl x509 -text | grep -A2 Validity
kube config in my case doesn't contain client-ceritficate-data. User section contains only standard jwt access token, refresh token, etc.
SRIJIT-BOSE-MSFT 4,346 Reputation points Microsoft Employee

2021-07-28T05:36:05.173+00:00

@Tomasz Sleboda , Thank you for your response.

We have investigated this internally and it seems like the best course of action would be to open a Microsoft technical support request. That way our engineers shall have deeper insights into the exact issue that your cluster is faced with.

2 answers

Your answer

SRIJIT-BOSE-MSFT 4,346 Reputation points Microsoft Employee

2021-07-20T12:54:10.573+00:00

@Tomasz Sleboda , Thank you for your question.

Can you please reset the AAD Application credentials as described here and check if this helps?
Tomasz Sleboda 6 Reputation points

2021-07-21T21:35:47.977+00:00

unfortunately,

Operation failed with status: 'Bad Request'. Details: Operation 'resetAADProfile' is not allowed for managed AAD enabled cluster.
SRIJIT-BOSE-MSFT 4,346 Reputation points Microsoft Employee

2021-07-22T06:59:30.163+00:00

@Tomasz Sleboda , Thank you for your response. We are checking this internally. We'll reach out to you as we have more information.
SRIJIT-BOSE-MSFT 4,346 Reputation points Microsoft Employee

2021-07-22T17:12:40.017+00:00

@Tomasz Sleboda , can you please check and rotate cluster certificates if invalidated? [How-to guide]
Tomasz Sleboda 6 Reputation points

2021-07-25T19:56:49.893+00:00

@SRIJIT-BOSE-MSFT , I've just checked certificates and they seem to be ok:
a) curl https://{apiserver-fqdn} -k -v 2>&1 |grep expire
* expire date: Jun 16 21:40:45 2023 GMT
b) az vm run-command invoke -g MC_rg_myAKSCluster_region -n vm-name --command-id RunShellScript --query 'value[0].message' -otsv --scripts "openssl x509 -in /etc/kubernetes/certs/apiserver.crt -noout -enddate"
Enable succeeded:
[stdout]
notAfter=Jun 16 21:40:45 2023 GMT

[stderr]
c) kubectl config view --raw -o jsonpath="{.users[?(@.name == 'clusterUser_rg_myAKSCluster')].user.client-certificate-data}" | base64 -d | openssl x509 -text | grep -A2 Validity
kube config in my case doesn't contain client-ceritficate-data. User section contains only standard jwt access token, refresh token, etc.
SRIJIT-BOSE-MSFT 4,346 Reputation points Microsoft Employee

2021-07-28T05:36:05.173+00:00

@Tomasz Sleboda , Thank you for your response.

We have investigated this internally and it seems like the best course of action would be to open a Microsoft technical support request. That way our engineers shall have deeper insights into the exact issue that your cluster is faced with.

Answer 1

Chitrabalan M 5

we can use sudo hwclock -s in the WSL to avoid this issue

Answer 2

Desmond Sindatry 36

I am having the same issue. I spun up the cluster from server X and that server has access to k8s endpoint. Now I go to server Y and after doing the steps above I dont have access. I believe its a FW issue at our end.

Share via

AKS AAD enabled kubectl: error: You must be logged in to the server (Unauthorized)

2 answers

Your answer