kubectl with managed certificate not working

I’ve created a Kubernetes cluster and followed the instructions to install doctl and authenticate it. I already had kubectl 1.14.x installed.

doctl is working fine, but following the instructions to use automated certificate management for kubectl isn’t working. kubectl complains that it can’t initialize the api client:

~/s/doctl $ kubectl get nodes
Error: unable to initialize DigitalOcean api client: access token is required. (hint: run 'doctl auth init')
Error: unable to initialize DigitalOcean api client: access token is required. (hint: run 'doctl auth init')
Error: unable to initialize DigitalOcean api client: access token is required. (hint: run 'doctl auth init')
Error: unable to initialize DigitalOcean api client: access token is required. (hint: run 'doctl auth init')
Error: unable to initialize DigitalOcean api client: access token is required. (hint: run 'doctl auth init')
Unable to connect to the server: getting credentials: exec: exit status 1

doctl is installed via snap as per the instructions:

~ $ doctl version
doctl version 1.20.0-dev
release 1.20.0 is available, check it out! 

kubectl version is 1.14.3:

~ $ kubectl version
Error: unable to initialize DigitalOcean api client: access token is required. (hint: run 'doctl auth init')
Client Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.3", GitCommit:"5e53fd6bc17c0dec8434817e69b04a25d8ae0ff0", GitTreeState:"clean", BuildDate:"2019-06-06T01:44:30Z", GoVersion:"go1.12.5", Compiler:"gc", Platform:"linux/amd64"}
Unable to connect to the server: getting credentials: exec: exit status 1

Running doctl auth init does this:

~ $ doctl auth init
Using token [7aee1cbdddb5a0161f05fea33f08a167a66972096c6202ad381410f6c73bb97e]

Validating token... OK

And doctl itself is working find and can see the cluster:

~ $ kubectl config get-contexts
CURRENT   NAME               CLUSTER            AUTHINFO                 NAMESPACE
*         do-lon1-azathoth   do-lon1-azathoth   do-lon1-azathoth-admin   

EDIT Just want to add, if I download the kubeconfig from the control panel it’s fine, but obv I’d rather have the managed authentication set up:

~ $ kubectl --kubeconfig=./Downloads/azathoth-kubeconfig.yaml get nodes
NAME                  STATUS   ROLES    AGE   VERSION
pool-f9sj2mv1p-x1hz   Ready    <none>   38h   v1.14.1