@bitter-dentist-28132 For anyone else having this issue, there is some discussion about it in the DO forums. It appears to be a known issue in DO, the workaround is to refresh your kubeconfig manually using doctl. Anyone else know anything about this?

I worked around this by doing

const cluster = new digitalocean.KubernetesCluster("foo", {
        name: 'foo',
        // ...
    });

    try {
        // first try to get the kubeconfig from a pre-existing cluster. this
        // is done to workaround the 7-day expiry of kubeconfigs from DO
        kubeConfig = pulumi.secret(digitalocean.getKubernetesCluster(
            {name: 'foo'}).kubeConfigs[0].rawConfig);
    } catch (e) {
        // if we can't do that, simply grab the kubeconfig from the cluster we
        // just created
        kubeConfig = pulumi.secret(cluster.kubeConfigs[0].rawConfig);
    }