error: You must be logged in to the server

The “You must be logged in to the server” error means kubectl reaches the API server but your credentials are missing, expired, or invalid, so access is denied.

What It Means

Kubectl successfully established a TCP connection to the API server, but the server returned a 401 Unauthorized or 403 Forbidden response. The error wording varies by cluster configuration, but the root cause is always authentication or authorization failure.

Why It Happens

• Your cloud provider session has expired (GCP, AWS, Azure credentials are stale).
• The kubeconfig file is missing or contains invalid token data.
• The client certificate in your kubeconfig has expired.
• You’re using the wrong context or user for the target cluster.
• RBAC permissions have been revoked or changed.
• The cluster uses OIDC and your identity token has expired.

How to Fix It

Step 1: Re-authenticate with your cloud provider

Google Cloud (GKE):

gcloud container clusters get-credentials <cluster-name> --region <region>
gcloud auth login

AWS (EKS):

aws eks update-kubeconfig --region <region> --name <cluster-name>
aws sts get-caller-identity  # Verify you're authenticated

Azure (AKS):

az aks get-credentials --resource-group <rg> --name <cluster-name>
az login

Step 2: Verify your kubeconfig

Check which context is active and inspect its user configuration:

kubectl config current-context
kubectl config view --minify

Look for user, token, client-certificate, or client-key entries. If they’re missing or expired, the context is broken.

Step 3: Refresh an expired token

If your kubeconfig contains an expired token, renew it:

kubectl config unset users.<user>.token
# Then re-authenticate with your cloud provider CLI

Step 4: Check RBAC permissions

Even when authenticated, you need proper RBAC permissions:

kubectl auth can-i list pods
kubectl auth can-i create deployments

If these return “no”, contact your cluster administrator to grant the necessary roles.

Step 5: Merge a new kubeconfig

If you received a new kubeconfig from your admin:

export KUBECONFIG=~/.kube/config:/path/to/new-config
kubectl config view --flatten > ~/.kube/config