Frequent Device Login Prompts When Switching Regions (China and Global)

[vibin18]

I'm using kubelogin to authenticate kubectl CLI access across multiple AKS clusters in different regions (e.g., China and Europe). However, when I switch contexts between clusters in these regions, I’m frequently prompted to perform a device login for every kubectl command.

This behavior appears inconsistent with expected token caching. It seems that tokens are not being reused or cached correctly across regions or Azure cloud environments (e.g., Azure China vs Azure Global).

[weinong]

@vibin18 have you tried the latest version? what login mode did you use?

[jan-mrm]

Got a similar behaviour, I think.
We used to use the device code login. But since 2.0.0 and the rework of the caching there is only one auth.json file used instead of multiple files, one for each Azure EntraId tenant and cloud. Since the user and tenant are in that one file, swapping to another cluster in another tenant will repeatedly initiate a device code flow login, since it does not overwrite the tenant and user in the auth.json.
Not overwriting is one thing but even with overwriting it be cumbersome to always do a device code flow when swapping tenants.
We figured to solve this we could use the --cache-dir and have them different for each tenant or cluster.
But this does not allow paths relative to home, like: ~/.kube/cache/kubelogin/cluster1 only absolut paths are allowed, as far as I tested. But we'd like to share a base kube config file.
Is there a way around that which we are missing? Or is that something that could be added?

[brianrowlett]

I also have similar behavior, using v0.2.10 devicecode flow (without the --legacy option). I have tried adding --cache-dir and while it does store multiple auth.json files in different directories, I am still prompted to reauthenticate frequently (it seems inconsistent though, it's not necessarily on every kubectl command).

[Kytech]

Looks like I am also having a similar issue. I've noticed that the token caching seems to be working for US-based Azure regions, which are the ones I access most regularly, but when I try to access other regions in another country, such as Europe, I get the prompt to login for every kubectl command I run. Just tried with the following build of kubelogin:

kubelogin version
git hash: v0.2.12/7124d5762def6053add4e0768186ebe53fdfbe71
Go version: go1.24.7
Build time: 2025-10-16T19:32:26Z
Platform: darwin/arm64

Looks like I'm reverting back to pre-0.2, since that's the last version that hasn't given me consistent issues with re-auth prompts every time I run a kubectl command.

Perhaps this is related to #654 and the fix there didn't fully resolve the issue, given how similar the behavior is?

[jan-mrm]

Looks like I am also having a similar issue. I've noticed that the token caching seems to be working for US-based Azure regions, which are the ones I access most regularly, but when I try to access other regions in another country, such as Europe, I get the prompt to login for every kubectl command I run. ...

Do you use a different user for each region or are the Entra tenants different between the regions? Or are both user and tenant the same for the different regions?

[Kytech]

Looks like I am also having a similar issue. I've noticed that the token caching seems to be working for US-based Azure regions, which are the ones I access most regularly, but when I try to access other regions in another country, such as Europe, I get the prompt to login for every kubectl command I run. ...

Do you use a different user for each region or are the Entra tenants different between the regions? Or are both user and tenant the same for the different regions?

I know that I use the same login for each region, but I don't have any info about whether my organization uses different Entra tenants between regions.