Introduction

The error about being unable to read client-cert or client-key usually means kubectl is pointing at certificate paths that do not exist, are unreadable, or no longer match your current Minikube profile. The actual failure is often in kubeconfig, not in kubectl get pods itself.

With Minikube, the fastest path to a fix is to inspect the current context, verify the certificate paths in kubeconfig, and regenerate the local context if it has gone stale.

Check the Current Minikube Context

Start by verifying that Minikube is the active context and that the cluster is running:

kubectl config current-context
minikube status

If the current context is not Minikube, kubectl may be reading credentials for a different cluster entirely.

Next, inspect the raw kubeconfig entries:

kubectl config view --raw

Look for the client-certificate and client-key paths under the active user entry. If those files do not exist anymore, the error makes sense immediately.

Common Cause: Stale or Broken Kubeconfig Paths

Minikube usually manages kubeconfig for you, but paths can become stale if:

• the Minikube profile was deleted and recreated
• files under the Minikube directory were moved or removed
• 'KUBECONFIG points to an unexpected file'
• the active context references credentials from an older setup

A quick repair step is:

minikube update-context

That refreshes the current kubeconfig entries for the active profile.

Verify the Files Exist

Minikube commonly stores certificate material under its own directories. After inspecting kubeconfig, verify that the referenced files are real and readable:

ls -l ~/.minikube
ls -l ~/.kube

If the files named in kubeconfig are missing, kubectl cannot authenticate. If the files exist but permissions are wrong, the error can look similar.

If Context Repair Is Not Enough

If minikube update-context does not fix the issue, restart the profile:

minikube stop
minikube start

That often regenerates the local configuration cleanly.

If the profile is badly damaged and the cluster is disposable, a full reset is the blunt but effective option:

minikube delete
minikube start

Do this only if you are comfortable recreating the local cluster.

Check KUBECONFIG

Another common source of confusion is a custom KUBECONFIG environment variable. If it points somewhere unexpected, kubectl may ignore the kubeconfig file you thought it was using.

Check it with:

echo "$KUBECONFIG"

If it is set to a different path, either inspect that file or temporarily unset the variable and try again.

Why the Error Mentions Certs Instead of Context

kubectl reads kubeconfig and then tries to load the certificate and key referenced there. If those files are missing, unreadable, or invalid, the failure appears as a certificate-read problem even though the root cause may be a stale context.

That is why inspecting kubeconfig directly is more productive than repeatedly rerunning kubectl get pods and hoping the message changes.

Common Pitfalls

The biggest mistake is assuming the issue must be with the Minikube VM or container when the real problem is the local kubeconfig file.

Another common issue is forgetting that KUBECONFIG can override the default config path.

A third problem is regenerating Minikube state while still using an old user entry or context in kubeconfig.

Finally, do not edit kubeconfig blindly. Inspect the active context first so you know which cluster and user entry are actually in play.

Summary

• This error usually points to stale or unreadable certificate paths in kubeconfig.
• Verify the active context with kubectl config current-context and inspect kubeconfig with kubectl config view --raw.
• Run minikube update-context to refresh Minikube's kubeconfig entries.
• Check whether KUBECONFIG is pointing somewhere unexpected.
• If necessary, restart or recreate the Minikube profile to regenerate credentials cleanly.