Troubleshooting
Read the error and operation report to identify completed steps before retrying. An error does not mean earlier changes were undone.
Connection and permission errors
Check the administrator kubeconfig, selected context, API server address, and network access to the cluster. Set --kubeconfig and --context explicitly in the CLI, or select the context again in the TUI.
For Forbidden errors, review the administrator permissions. Creating bindings may require additional RBAC authorization; dry runs also require the relevant permissions. License activation cannot fix missing cluster permissions.
Output file errors
kticket does not overwrite existing files or symlinks. In the CLI, use --output to select a new filename. In the TUI, select an existing writable directory and check the paths on the review screen. Keep recipient kubeconfigs separate from the administrator configuration.
Partial issuance or permission changes
| Situation | Next step |
|---|---|
| Issuance fails after creating resources | Read the report and use kticket list and kticket access list to inspect remaining accounts and grants. |
| A token was issued, but a later step failed | Inspect the report first. TUI accounts marked Needs attention are excluded from automatic retry. |
| A batch stops partway through | Press r in the same session to recheck failed or pending accounts. Successful accounts are skipped. The batch cannot be restored after exiting. |
| Grant changes partially fail | Reload the account and generate a new plan. Completed changes are not rolled back. |
| Credential history is unreadable or full | Save the error and ask the cluster administrator to inspect account records before reissuing. Deleting records does not revoke tokens. |
After failed issuance, kticket attempts to remove the incomplete output file and reports cleanup errors. Changes already made to accounts, namespaces, and grants may remain. A token may have been issued even if its output file was removed. Revoke the account if you need to invalidate all its credentials.
Access remains or revocation cleanup fails
Removing one grant does not delete the account or remove permissions supplied by external bindings. Use kticket access check to check whether a specific operation is still allowed.
Account revocation affects all its credentials but does not terminate established connections. If the account was deleted but binding cleanup failed, inspect the remaining managed bindings with administrator credentials. Finish cleanup before recreating the same account name. Do not delete shared roles or other accounts’ bindings.
License problems
Run kticket license status to see the state, current Machine ID, and license file location.
| Situation | Next step |
|---|---|
| No license email | Check the checkout email address and spam folder, then contact support with your order details. |
| License not found | Install the attachment as the system user running kticket. Check that KTICKET_LICENSE_FILE matches the setting used during installation. |
| Installation refuses to overwrite a file | If replacement is intended, use kticket license install --force FILE. |
wrong machine | Compare the current Machine ID with the value submitted at purchase. Contact support if the hardware changed. |
| Invalid or damaged file | Restore the unmodified attachment from the original email. Contact support if it still fails. |
| Unrecognized signing key | Update kticket and retry. Contact support if you already have the latest version. |
See license purchase and activation for the full installation steps.
Contact support
Use the support page and include your kticket version, operating system, command, and error message. For payment or license issues, include the order reference and Machine ID. Remove tokens, administrator kubeconfigs, and other credentials before sharing diagnostics publicly or by email.