kubectl "exec plugin ... exec format error" - Fix Auth Plugin Binary in CI

kubectl runs an external credential plugin (via the kubeconfig exec block) to mint a token. exec format error means the OS could not run that plugin binary - it is built for a different architecture, is a text/script stub, or is corrupt.

What this error means

kubectl fails with exec ... exec format error while invoking the auth plugin named in kubeconfig (e.g. aws-iam-authenticator, gke-gcloud-auth-plugin). Authentication never completes because the plugin binary cannot execute on this runner.

kubectl output

error: exec plugin: invalid apiVersion; OR
fork/exec /usr/local/bin/aws-iam-authenticator: exec format error

Common causes

Plugin built for the wrong architecture

An amd64 plugin binary on an arm64 runner (or vice versa) cannot be executed, producing exec format error. Common when a Dockerfile/installer hard-codes one arch.

Binary is not a real executable

The "binary" is actually an HTML error page, a shell script without a shebang, or a truncated download - so the loader rejects it.

How to fix it

Verify the plugin binary matches the runner arch

Check the file type and the runner architecture; they must agree.

Terminal

uname -m                       # x86_64 or aarch64
file $(command -v aws-iam-authenticator)
aws-iam-authenticator version

Install the correct-arch plugin

Download the plugin build matching the runner CPU architecture (amd64 vs arm64).
For GKE, install gke-gcloud-auth-plugin via the gcloud components for the right platform.
Confirm the download succeeded (not an HTML/redirect body) and the file is executable.

How to prevent it

Install auth plugins by architecture-aware package, not a hard-coded URL.
Pin and verify plugin checksums so a corrupt/HTML download fails fast.
Run the plugin’s version command in CI to validate it executes before kubectl needs it.