Add new AKS Arc kubectl TSG

Author: sethmanheim

AKS-Arc/TOC.yml

@@ -187,6 +187,8 @@
       href: network-validation-errors.md
     - name: Network validation error due to .local domain
       href: network-validation-error-local.md
+    - name: Entra authentication prompts when running kubectl
+      href: entra-prompts.md
   - name: Reference
     items:
     - name: Azure CLI

AKS-Arc/entra-prompts.md

@@ -0,0 +1,38 @@
+---
+title: Entra authentication prompts when running kubectl with Kubernetes RBAC
+description: Learn how to troubleshoot Entra authentication issues when using kubectl with Kubernetes RBAC.
+author: sethmanheim
+ms.author: sethm
+ms.topic: troubleshooting
+ms.date: 06/17/2025
+ms.reviewer: leslielin
+ms.lastreviewed: 06/17/2025
+
+---
+
+# Troubleshoot Entra authentication prompts when running kubectl with Kubernetes RBAC
+
+This article helps you diagnose and resolve issues related to repeated Entra authentication prompts when using **kubectl** with Kubernetes RBAC on AKS enabled by Azure Arc.
+
+## Symptoms
+
+When you use **kubectl** with [Microsoft Entra authentication and Kubernetes RBAC](kubernetes-rbac-local.md) in AKS on Azure Local, Entra authentication prompts appear after each command execution.
+
+## Possible causes
+
+This issue is caused by a [GitHub bug](https://github.com/Azure/kubelogin/issues/654) introduced in **kubelogin** version 0.2.0 and later.
+
+## Mitigation
+
+To mitigate this issue, you can use one of the following two methods:
+
+- Downgrade **kubelogin** to version 1.9.0. This stable version does not have the bug that causes repeated authentication prompts. You can [download this version from the GitHub repository](https://github.com/int128/kubelogin/releases/tag/v1.9.0). Select the appropriate asset for your OS or architecture, extract it, and replace your existing **kubelogin** binary.
+- Alternatively, if you have administrator permissions, you can use the `--admin` flag with the `az aksarc get-credentials` command. This method bypasses **kubelogin** authentication by retrieving admin credentials directly:
+
+  ```azurecli
+  az aksarc get-credentials -g $resource_group_name -n $aks_cluster_name --file <file-name> --admin
+  ```
+
+## Next steps
+
+[Troubleshoot issues in AKS enabled by Azure Arc](aks-troubleshoot.md)