<p>I'm trying to add a new cluster and its context in the kubeconfig file using username and password but its failing. Below are the commands I'm using to set-context.</p>

<pre><code>kubectl config  set-cluster lab101 --server=https://api-kube.example.com:8443 --insecure-skip-tls-verify --context=lab101
kubectl config set-credentials kubeadmin --username=kubeadmin --password=xxxxxxx --cluster=lab101
kubectl config  set-context lab101 --cluster=lab101 --namespace=default --user=kubeadmin
kubectl config use-context lab101
</code></pre>

<p><strong>Logs:</strong></p>

<pre><code>GET https://api-kube.example.com:8443/api?timeout=32s 403 Forbidden in 19 milliseconds
I0422 11:37:31.741005   18972 round_trippers.go:411] Response Headers:
I0422 11:37:31.741005   18972 round_trippers.go:414]     Cache-Control: no-cache, private
I0422 11:37:31.741005   18972 round_trippers.go:414]     Content-Type: application/json
I0422 11:37:31.741005   18972 round_trippers.go:414]     X-Content-Type-Options: nosniff
I0422 11:37:31.741005   18972 round_trippers.go:414]     Content-Length: 188
I0422 11:37:31.741005   18972 round_trippers.go:414]     Date: Wed, 22 Apr 2020 15:37:31 GMT
I0422 11:37:31.762977   18972 request.go:897] Response Body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"forbidden: User \"system:anonymous\" cannot get path \"/api\"","reason":"Forbidden","details":{},"code":403}
</code></pre>

<p>Note: If I use the same user,password with <code>oc login</code> they work fine. Doesn't understand why it won't work if I set kubeconfig manually.</p>

<p>It's unlikely that OpenShift Kubernetes allows authentication using <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#static-password-file" rel="nofollow noreferrer">username and password</a>. The <code>oc login</code> command internally authenticate using username and password to a <a href="https://docs.openshift.com/container-platform/3.10/architecture/additional_concepts/authentication.html#integrations" rel="nofollow noreferrer">oAuth server</a> to get a bearer token which automatically is stored in the kubeconfig file used by kubectl. When you do any kubectl command that token is used to authenticate with the Kubernetes cluster.</p>

<p>You can check the token via  <code>oc config view</code>. You can get the token and set it with <code>kubectl config set-credentials kubeadmin  --token=bearertoken</code> and it should work.</p>

<p>Refer the docs <a href="https://docs.openshift.com/container-platform/3.10/cli_reference/get_started_cli.html#cli-configuration-files" rel="nofollow noreferrer">here</a>.</p>

<p>Alternatively you can follow this doc <a href="https://docs.openshift.com/container-platform/3.10/architecture/additional_concepts/authentication.html#obtaining-oauth-tokens" rel="nofollow noreferrer">here</a> to get a bearer token.</p>
