kubectl exec auth plugin (aws-iam-authenticator / gke-gcloud-auth-plugin) not found in CI - Fix it

Modern kubeconfigs use an exec credential plugin to mint short-lived tokens from cloud IAM. If the named binary (aws-iam-authenticator, gke-gcloud-auth-plugin) is not on PATH, kubectl cannot get a token and the command fails before reaching the API server.

What this error means

kubectl fails with exec: executable gke-gcloud-auth-plugin not found or aws-iam-authenticator: executable file not found in $PATH, often after a working credential fetch.

Unable to connect to the server: getting credentials: exec: executable
gke-gcloud-auth-plugin not found

It looks like you are trying to use a client-go credential plugin that is not installed.

Common causes

The auth plugin is not installed on the runner

The kubeconfig references an exec plugin, but the slim runner image never installed that binary.

The plugin is installed but not on PATH

The binary exists in a directory the step does not include in PATH, so kubectl cannot execute it.

How to fix it

Install the exec auth plugin before kubectl

Install the provider auth plugin and make sure it is on PATH, then fetch credentials.

gcloud components install gke-gcloud-auth-plugin
export USE_GKE_GCLOUD_AUTH_PLUGIN=True
gcloud container clusters get-credentials prod --zone us-central1-a

For EKS, install aws-iam-authenticator

Newer kubeconfigs may call aws eks get-token instead; either way the named binary must be present.

curl -Lo /usr/local/bin/aws-iam-authenticator \
  https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/latest/download/aws-iam-authenticator_linux_amd64
chmod +x /usr/local/bin/aws-iam-authenticator

How to prevent it

• Bake the cloud auth plugin into the runner image.
• Verify the plugin is on PATH in a pre-flight step.
• Keep the plugin version aligned with the cluster version requirements.

Related guides