kubectl "exec plugin" / "getting credentials" Failed in CI

Your kubeconfig uses an exec credential plugin (aws/gcloud/aws-iam-authenticator) to fetch a token, and that helper binary is missing or failing on the CI runner - so kubectl cannot obtain a credential at all.

What this error means

kubectl fails with exec: executable <tool> not found or getting credentials: exec: ... no such file or directory. Nothing reaches the API server because the credential step itself failed.

kubectl output

Unable to connect to the server: getting credentials: exec: executable
aws not found

It looks like you are trying to use a client-go credential plugin that is not
installed.

Common causes

The auth helper is not installed

The kubeconfig’s users[].user.exec.command points at a CLI (aws, gke-gcloud-auth-plugin, aws-iam-authenticator) that is not on the runner’s PATH.

Helper present but misconfigured

The plugin exists but cannot get credentials - missing cloud env vars, wrong region/profile, or a too-old apiVersion in the exec config.

How to fix it

Install the credential plugin the kubeconfig expects

Add the helper before any kubectl call. Read the required command from the kubeconfig.

Terminal

# example: GKE auth plugin
gcloud components install gke-gcloud-auth-plugin
# or EKS uses the aws CLI directly - ensure it is installed and on PATH
aws --version

Provide the helper’s required environment

Check users[].user.exec in the kubeconfig to see the command and args.
Export the cloud credentials/region the plugin needs (e.g. AWS_REGION, profile).
Bump the exec apiVersion to client.authentication.k8s.io/v1 if the plugin requires it.

How to prevent it

Install the cloud auth plugin as a setup step in CI runner images.
Generate the kubeconfig with the cloud CLI so the exec block matches the installed tool.
Pin the auth plugin version alongside kubectl.