<p>Today I met a strange issue about my Windows kubectl client suddenly raise authorization issue in connecting ICp.</p>

<p>I was using ICP with a Widows configured kubectl.exe. Then, after a while, due to laptop automatic sleeping, my VPN connection was disconnected,  hence lose connection to remote ICP. Later I came back and re-connect the ICP. I use kubectl command again and faced:</p>

<p>error: You must be logged in to the server (Unauthorized)</p>

<p>On ICP master node, nothing wrong if I used:</p>

<p><strong>kubectl -s 127.0.0.1:8888 -n kube-system get pods -o wide</strong></p>

<p>I went back to re-configure client (pasted the code copied from admin -> configure kubectl), commands executed successful but when I issue</p>

<p><strong>kubectl get pods</strong></p>

<p>still error.</p>

<p>I checked article:</p>

<p><a href="https://stackoverflow.com/questions/45540139/kubectl-error-you-must-be-logged-in-to-the-server">kubectl - error: You must be logged in to the server</a></p>

<p><a href="https://stackoverflow.com/questions/43111366/kubectl-error-you-must-be-logged-in-to-the-server-the-server-has-asked-for-th">kubectl error: &quot;You must be logged in to the server (the server has asked for the client to provide credentials)&quot;</a></p>

<p><a href="https://stackoverflow.com/questions/44457609/error-you-must-be-logged-in-to-the-server-the-server-has-asked-for-the-client">error: You must be logged in to the server (the server has asked for the client to provide credentials)</a></p>

<p>It looks like didn't much helpful</p>

<p>It turns out that the tokens was invalid (not sure if it because of 12 hours expiration). If you simply F5 the browser page you didn't re-authenticated but still can access the console page, but actually the token should be updated by re-login ICP Portal again.</p>

<p>The issue was fixed by re-access the ICP portal:</p>

<pre><code>https://&lt;master host&gt;:8443/console/
</code></pre>

<p>This will re-allow you authenticate. After that, go to admin -> configure client, paste the latest commands you will find the token might be updated. Executing the new commands solved the issue.</p>

<p>2 Question still left: </p>

<p>a) If the page was long opened and token expired, ICP portal page may not auto refreshed to force you re-login, that means the token in set-credentials command are still old. </p>

<p>b) Even setting old tokens are accepted and command never complain an error even warning. This may mislead us when token are changed on servers, e.g, If I saved the commands to a local txt file and re-execute it again (even after token expired), the commands still finished successful, but actually I still didn't get authenticated correctly when I try to login.</p>
