Fix: k8s auth Error Handling

[mohamedzeidan2021]

What's changing and why?

• Enhanced the CLI's error handling with k8s authentication that addresses confusing raw API error messages that users encounter when authentication fails.
• Users currently see confusing 401 Unauthorized errors with raw k8s responses instead of actionable guidance.

Changes

• CLI checks k8s connectivity before executing commands that require it
• raw API errors are replaced with user friendly messages
• Error messages guide users to HPCLI commands

Before/After UX

Before:

$ hyp get-operator-logs hyp-jumpstart-endpoint --since-hours 1
Failed to verify Kubernetes version compatibility: (401)
Reason: Unauthorized
HTTP response headers: HTTPHeaderDict({'Audit-Id': '37bb5f8d-9beb-4f1d-ad71-f6cfc7fcddd6', 'Cache-Control': 'no-cache, private', 'Content-Type': 'application/json', 'Date': 'Tue, 16 Sep 2025 18:49:30 GMT', 'Content-Length': '129'})
HTTP response body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"Unauthorized","reason":"Unauthorized","code":401}

After:

$ hyp get-operator-logs hyp-jumpstart-endpoint --since-hours 1
❌ Kubernetes authentication failed (401 Unauthorized).
Current context: my-hyperpod-cluster

This usually means your credentials have expired or are invalid.

To fix this:
1. Reconfigure cluster access:
   hyp set-cluster-context <cluster-name> --region <region>
2. Try your HyperPod command again

💡 This will refresh your authentication with the cluster.

Other cases covered

No Kubeconfig

❌ Kubernetes configuration not found.
No kubeconfig file found. Please ensure you have:
1. A valid kubeconfig file at ~/.kube/config, or
2. Set the KUBECONFIG environment variable

To configure cluster access:
  hyp set-cluster-context <cluster-name> --region <region>

💡 This will set up the necessary Kubernetes configuration for your HyperPod cluster.

AWS Credentials Issue

❌ Kubernetes authentication failed (401 Unauthorized).
Current context: my-hyperpod-cluster

🔍 AWS credentials issue detected:
Your AWS credentials appear to be missing or invalid.

To fix this:
1. Check your AWS credentials:
   aws sts get-caller-identity
2. If expired, refresh your AWS credentials
3. Then reconfigure cluster access:
   hyp set-cluster-context <cluster-name> --region <region>

💡 Make sure your AWS credentials have the necessary EKS permissions.

RBAC Permissions Issue

❌ Kubernetes access denied (403 Forbidden).
You don't have permission to access this cluster or resource.

This could mean:
1. Your user/role lacks the necessary RBAC permissions
2. You're connected to the wrong cluster
3. The cluster's access policies have changed

To fix this:
1. Verify you're using the correct cluster context
2. Contact your cluster administrator for access
3. Ensure your AWS role has the necessary EKS permissions

How was this change tested?

Added unit tests, and tested most of the cases on my local machine with expired aws credentials and invalid cluster contexts.

Are unit tests added?

Yes, 30+ tests for k8s connectivity, aws credentials check, checking current k8s context, end-to-end decorator functionality.

Are integration tests added?

No

Reviewer Guidelines

‼️ Merge Requirements: PRs with failing integration tests cannot be merged without justification.

One of the following must be true:

• All automated PR checks pass
• Failed tests include local run results/screenshots proving they work
• Changes are documentation-only