# Failed to submit session Jupyter Kubernetes ~ error: error reading input for Password

**URL:** <https://discourse.openondemand.org/t/failed-to-submit-session-jupyter-kubernetes-error-error-reading-input-for-password/4548>\
**Category:** Get Help\
**Tags:** question\
**Created:** [September 27, 2025, 5:39pm UTC](https://discourse.openondemand.org/t/failed-to-submit-session-jupyter-kubernetes-error-error-reading-input-for-password/4548 "2025-09-27T17:39:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![irfanardi3001](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/irfanardi3001/32/2593_2.png) [@irfanardi3001](https://discourse.openondemand.org/u/irfanardi3001)\
**Post date:** [September 27, 2025, 5:39pm UTC](https://discourse.openondemand.org/t/failed-to-submit-session-jupyter-kubernetes-error-error-reading-input-for-password/4548/1 "2025-09-27T17:39:02Z")

</div>

Hi, I was clone Jupyter app for my ondemand with kubernetes cluster from repo [GitHub - OSC/bc\_k8s\_jupyter: Run a batch connect Jupyter in a kuberentes cluster](https://github.com/OSC/bc_k8s_jupyter) (so my form.yml and submit.yml.erb is same as github version without no change) and I facing this problem with this error `error: error reading input for Password` and need the help

 ![image](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/4/49dbbf09a00871786b565dabc94aa9517f1216c6.png)

I read this discourse [Running Jupyter on K8s via OOD](https://discourse.openondemand.org/t/running-jupyter-on-k8s-via-ood/4173) and still didn’t has the solving.

Here is my cluster configuration `/etc/ood/config/clusters.d/k3s_cluster.yml`:

> v2:  
> metadata:  
> title: “k3s-cluster”  
> login:  
> host: “ondemand-dev.mytestdev.my.id”  
> job:  
> adapter: “kubernetes”  
> config\_file: “~/.kube/config”  
> cluster: “open-ondemand”  
> context: “open-ondemand”  
> bin: “/usr/bin/kubectl”  
> username\_prefix: “prod-”  
> namespace\_prefix: “user-”  
> all\_namespaces: false  
> auto\_supplemental\_groups: false  
> server:  
> endpoint: “[https://192.168.1.4:6443](https://192.168.1.4:6443)”  
> cert\_authority\_file: “~/.kube/ca.crt”  
> auth:  
> type: “oidc”  
> mounts:   
> batch\_connect:  
> ssh\_allow: false  
> basic:  
> script\_wrapper: |  
> module purge  
> %s  
> vnc:  
> script\_wrapper: |  
> module purge  
> export PATH=“/opt/TurboVNC/bin/vncserver”  
> export WEBSOCKIFY\_CMD=“/usr/bin/websockify”  
> %s

since `error: error reading input for Password` is might from `--cluster`, so I check the `~/.kube/config` configuration

> apiVersion: v1  
> clusters:
> 
> - cluster:  
> certificate-authority: ca.crt  
> server: [https://192.168.1.4:6443](https://192.168.1.4:6443)  
> name: kubernetes
> - cluster:  
> certificate-authority: /home/sinaupc/.kube/ca.crt  
> server: [https://192.168.1.4:6443](https://192.168.1.4:6443)  
> name: open-ondemand  
> contexts:
> - context:  
> cluster: kubernetes  
> user: ondemand@kubernetes  
> name: ondemand@kubernetes
> - context:  
> cluster: open-ondemand  
> namespace: user-sinaupc  
> user: prod-sinaupc  
> name: open-ondemand  
> current-context: open-ondemand  
> kind: Config  
> users:
> - name: ondemand@kubernetes  
> user:  
> token:
> - name: prod-sinaupc  
> user:  
> token:

I use cluster `open-ondemand` and context `open-ondemand`. For token I follow the instruction [Tokens for Bootstrapping](https://osc.github.io/ood-documentation/latest/installation/resource-manager/kubernetes.html#tokens-for-bootstrapping). Since I use Keycloack for OIDC authentication, I use `auth:``type: “oidc”` and follow this instruction [OIDC Audience](https://osc.github.io/ood-documentation/latest/installation/resource-manager/kubernetes.html#keycloak) for create audiance mapper. Also follow the instruction for [Deploy Hooks to bootstrap users Kubernetes](https://osc.github.io/ood-documentation/latest/installation/resource-manager/kubernetes.html#deploy-hooks-to-bootstrap-users-kubernetes-configuration)

Here is the log in `/var/log/ondemand-nginx/sinaupc/error.log`

> App 11937 output: [2025-09-28 15:49:48 +0000] INFO “execve = [{}, “/usr/bin/kubectl --kubeconfig=~/.kube/config --context=open-ondemand --namespace=user-sinaupc -o json create -f -”]”  
> App 11937 output: [2025-09-28 15:49:48 +0000] ERROR “ERROR: OodCore::JobAdapterError - error: error reading input for Password”  
> App 11937 output: [2025-09-28 15:49:48 +0000] INFO “execve = [“git”, “describe”, “–always”, “–tags”]”

Also I try to change exec these script to run hook and create new namespaces, network, rolebinding, etc and hope for auth credential for kubeconfig  
`sudo -E /opt/ood/hooks/k8s-bootstrap/k8s-bootstrap-ondemand.sh sinaupc /etc/ood/config/hook.env` and `sudo -u sinaupc /opt/ood/hooks/k8s-bootstrap/set-k8s-creds.sh sinaupc /etc/ood/config/hook.env`

From these, I got new namespace `user-sinaupc`, but in kubeconfig `.kube/config` I only get this update configuration:

> name: prod-sinaupc  
> user:  
> auth-provider:  
> config:  
> client-id: ondemand-dev.mytestdev.my.id  
> client-secret: secret  
> id-token: “”  
> idp-issuer-url: [https://ondemand-idpdev.mytestdev.my.id/realms/ondemand](https://ondemand-idpdev.mytestdev.my.id/realms/ondemand)  
> refresh-token: “”  
> name: oidc

I don’t know why id-token and refresh-token is missed. I try to get the token and refresh from my user with this command  
`TOKEN=$(curl -s -X POST “$ISSUER/protocol/openid-connect/token” `  
`-d “grant_type=password” `  
`-d “client_id=$CLIENT_ID” `  
`-d “client_secret=$CLIENT_SECRET” `  
`-d “username=sinaupc” `  
`-d “password=<password>” `  
`-d “scope=openid offline_access k3s-audience” | jq -r ‘.access_token’)`

`REFRESH=$(curl -s -X POST “$ISSUER/protocol/openid-connect/token” `  
`-d “grant_type=password” `  
`-d “client_id=$CLIENT_ID” `  
`-d “client_secret=$CLIENT_SECRET” `  
`-d “username=sinaupc” `  
`-d “password=<password>” `  
`-d “scope=openid offline_access k3s-audience” | jq -r ‘.refresh_token’)`

And put the `$TOKEN` and `$REFRESH` on my kubeconfig like

> name: prod-sinaupc  
> user:  
> auth-provider:  
> config:  
> client-id: ondemand-dev.mytestdev.my.id  
> client-secret: secret  
> id-token: “token from $TOKEN”  
> idp-issuer-url: [https://ondemand-idpdev.mytestdev.my.id/realms/ondemand](https://ondemand-idpdev.mytestdev.my.id/realms/ondemand)  
> refresh-token: “refresh token from $REFRESH”  
> name: oidc

But this is still didn’t solve my problem `error: error reading input for Password`

I didn’t know why OOD still need password, eventhough with this `context` and `user` I have access to kubectl without password

> sinaupc@ondemand-dev:~$ kubectl config use-context open-ondemand  
> Switched to context “open-ondemand”.  
> sinaupc@ondemand-dev:~$ kubectl get pods -n user-sinaupc  
> No resources found in user-sinaupc namespace.

What should I check again to solve this problem, do you have any solve?

---

<div class="post-metadata">

**Author:** ![irfanardi3001](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/irfanardi3001/32/2593_2.png) [@irfanardi3001](https://discourse.openondemand.org/u/irfanardi3001)\
**Post date:** [September 29, 2025, 10:49am UTC](https://discourse.openondemand.org/t/failed-to-submit-session-jupyter-kubernetes-error-error-reading-input-for-password/4548/2 "2025-09-29T10:49:12Z")

</div>

Ok solve  
But now, this happen when running a Jupyter container from OOD

 ![Screenshot 2025-09-29 092103](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/c/caf812d41363deeb68000816317b3536829a34d6.png)

---

<div class="post-metadata">

**Author:** ![jeff.ohrstrom](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/jeff.ohrstrom/32/136_2.png) [@jeff.ohrstrom](https://discourse.openondemand.org/u/jeff.ohrstrom)\
**Post date:** [September 29, 2025, 2:15pm UTC](https://discourse.openondemand.org/t/failed-to-submit-session-jupyter-kubernetes-error-error-reading-input-for-password/4548/3 "2025-09-29T14:15:18Z")

</div>

The 404 appears to be coming from Jupyter itself so that’s good. Can you share the `before.sh.erb` that loads it so we can see how it’s configured?

By the way, our production Jupyter app also runs on Kubernetes, so that may help with configuration.

> **[GitHub - OSC/bc\_osc\_jupyter: Batch Connect - OSC Jupyter Notebook Server](https://github.com/OSC/bc_osc_jupyter)**
>
> Batch Connect - OSC Jupyter Notebook Server

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [March 28, 2026, 2:16pm UTC](https://discourse.openondemand.org/t/failed-to-submit-session-jupyter-kubernetes-error-error-reading-input-for-password/4548/4 "2026-03-28T14:16:13Z")

</div>

Closed on March 28, 2026, 2:16pm UTC

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.