help-wanted: `ce cluster generate-token` shows an interactive re-auth prompt when the session token is expired, breaking kubectl exec credential plugin usage

[jaiakash]

Summary

When oci ce cluster generate-token is configured as a kubectl exec credential
plugin (the default kubeconfig generated by oci ce cluster create-kubeconfig
with --auth security_token), and the CLI session token has expired, the CLI
prints an interactive prompt:

ERROR: This CLI session has expired, so it cannot currently be used to run commands
Do you want to re-authenticate your CLI session profile? [Y/n]:

kubectl invokes the plugin without a TTY, so the prompt cannot be answered and
the command exits non-zero. All the user sees from kubectl is:

Unable to connect to the server: getting credentials: exec: executable oci failed with exit code 1

The real cause (expired session) is completely hidden, which makes this very
hard to diagnose — every kubectl command just appears broken.

Steps to reproduce

1. oci session authenticate --profile-name <profile> --region <region>
2. oci ce cluster create-kubeconfig --cluster-id <ocid> --auth security_token --profile <profile> ...
3. Use kubectl normally until the session token expires (~1 hour)
4. Run any kubectl command, e.g. kubectl get nodes

Actual behavior

Interactive [Y/n] prompt that cannot be answered in the exec-plugin context;
opaque exit code 1 from kubectl's perspective.

Environment

• OCI CLI version: 3.90.1
• Python: 3.14.6
• OS: macOS 27.0 (arm64)
• kubectl client: v1.36.3
• Auth: --auth security_token (session created via oci session authenticate)

Workaround

Manually run oci session authenticate --profile-name <profile> (or
oci session refresh) whenever kubectl starts failing with
"executable oci failed with exit code 1".

[pankajmjx]

Hi @jaiakash ,

This is expected behavior. The session token is short-lived by design, so once it expires, the session needs to be refreshed before the CLI can be used again. You can run oci session refresh --profile and then retry the kubectl command.

[jaiakash]

Hi ok i get it, it is supposed to short lived. But my token is expiring in like 30mins, is it expected?
Can we set the time of expiration?