p0cli: kubeconfig: Troubleshooting

Last updated: April 30, 2025

Troubleshooting Guide: 

When something goes wrong running p0 kubeconfig, use this guide to diagnose and resolve common issues.

1. Verify Prerequisites

Before diving into errors, confirm that all requirements are met:

  • P0 CLI:

p0 version

  • Ensure you’re on v0.9.0 or later.

  • Authentication:

p0 login <ORG_ID>

  • You should see confirmation in your browser.

  • AWS CLI + EKS plugin:

aws --version
aws eks help

  • The EKS subcommand must be available (AWS CLI v2.x with aws-eks).

  • kubectl:

kubectl version --client

  • kubectl v1.24 or higher is recommended.

If any of these fail, install or upgrade before proceeding.

2. Common Error Scenarios

2.1 Missing Dependencies

Error

Required dependencies are missing; please try again after installing them...

Cause

Either aws (with EKS plugin) or kubectl isn’t on your PATH.

Resolution

  • Install AWS CLI v2 and add it to PATH.

  • Install the EKS plugin (for AWS CLI v1) or upgrade to v2.

  • Install kubectl and ensure it’s executable:

curl -Lo kubectl https://dl.k8s.io/release/$(curl -L -s …)/bin/…
chmod +x kubectl && mv kubectl /usr/local/bin/

2.2 Invalid Role Argument

Error

Invalid format for role argument.
The role argument must be in one of the following formats:
- ClusterRole/<roleName>
- CuratedRole/<roleName>
- Role/<namespace>/<roleName>

Cause

The --role value doesn’t match the expected slash-separated syntax.

Resolution

Use exactly one or two slashes (no extra spaces except around the “/” in output), for example:

--role ClusterRole/cluster-admin
--role CuratedRole/view-secrets
--role Role/prod/developer

2.3 Invalid Resource Argument

Error

Invalid format for resource argument.
The resource argument must be in one of the following formats (spaces required):
- <Kind> / <Namespace> / <Name>
- <Kind> / <Name>

Cause

Missing or misplaced spaces around slashes.

Resolution

Include spaces on both sides of each slash:

--resource Pod / staging / my-pod-123
--resource Deployment / frontend-app

2.4 Cluster Integration Lookup Fails

Symptom

Hangs or errors in fetching cluster integration:

Error: Failed to fetch cluster integration for "<cluster-id>"

Causes

  • Cluster isn’t onboarded in P0 Security.

  • Network issues or incorrect org ID.

    Resolution

  • Verify the cluster ID in the P0 dashboard under Integrations → Kubernetes.

  • Ensure your machine can reach the P0 API (no proxy issues).

  • Run with P0_LOG=debug p0 kubeconfig … to see API call details.

2.5 AWS Credential Conflicts

Warning

Warning: AWS credentials were detected in your environment…

Cause

Existing AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars override the temporary P0-issued profile.

Resolution

Unset them before running:

unset AWS_ACCESS_KEY_ID
unset AWS_SECRET_ACCESS_KEY

2.6 aws eks update-kubeconfig Fails

Error

Failed to invoke `aws eks update-kubeconfig`
[followed by AWS CLI error text]

Possible Causes

  • Missing EKS plugin.

  • Incorrect region or cluster name parsed from ARN.

  • Expired or invalid AWS temporary credentials.

  • Manual test:

aws eks update-kubeconfig \
  --name <clusterName> \
  --region <clusterRegion> \
  --profile <generatedProfile>

  • If that fails, verify:

    • aws eks list-clusters --region <clusterRegion> --profile <generatedProfile>

    • The profile exists in ~/.aws/credentials.

  • Re-run p0 kubeconfig after confirming AWS CLI works independently.

2.7 kubectl config use-context Fails

Error

Failed to invoke `kubectl config use-context`
[followed by kubectl error]

Causes

  • kubectl isn’t installed or misconfigured.

  • The context name (ARN) doesn’t match any in your kubeconfig.

    Resolution

  • List contexts:

kubectl config get-contexts

  • If missing, inspect ~/.kube/config for the new context entry.

  • Ensure file permissions allow read/write.

2.8 ARN Parsing Errors

Error

Invalid EKS cluster ARN: arn:aws:eks:…:cluster/…

Cause

The stored ARN in P0 integration isn’t a valid EKS cluster ARN.

Resolution

  • In the P0 dashboard, correct the ARN under the Kubernetes integration.

  • It must look like:

arn:aws:eks:<region>:<accountId>:cluster/<clusterName>

2.9 Pending Approval or Timeouts

Symptom

Stuck on “Requesting access…” or “Waiting for AWS resources…” indefinitely.

Causes

  • P0 request not yet approved in Slack or UI.

  • AWS IAM propagation delay.

    Resolution

  • Approve the request in Slack or the P0 UI.

  • Wait 30 – 60 seconds for IAM role/session propagation.

  • Re-run if it times out.

3. Diagnostic Steps & Tips

  • Enable Debug Logging

export P0_LOG=debug
p0 kubeconfig …

  • Examine logs for HTTP calls, retries, and CLI invocations.

  • Check Versions

p0 version
aws --version
kubectl version --client

  • Inspect AWS Profiles & Credentials

    • aws configure list-profiles cat ~/.aws/credentials | grep <clusterProfile>

  • Manual AWS & kubectl Tests

aws eks list-clusters --region <region> --profile <profile>
kubectl config view

  • Review Kubeconfig File

grep -A2 "<clusterARN>" ~/.kube/config

4. When to Escalate

  • Integration Misconfiguration: If cluster IDs or ARNs in P0 are wrong—ask your infra/SRE team.

  • API Errors: Persistent 5xx or auth failures—contact P0 support with debug logs.

  • CLI Bugs: Unexpected stack traces—file an issue on GitHub with reproduction steps.

5. Support & Resources