Workaround for freelens proxy issues. See https://github.com/freelensapp/freelens/issues/766#issuecomment-4864299578

gistfile1.txt

#!/bin/bash

REAL_KUBECTL=/usr/bin/kubectl

if [[ -n "$KUBECONFIG" && -f "$KUBECONFIG" ]]; then
  # Extract cluster name and server from the Freelens temp kubeconfig
  export CLUSTER_NAME
  CLUSTER_NAME=$(yq '.clusters[0].name' "$KUBECONFIG")
  temp_server=$(yq '.clusters[0].cluster.server' "$KUBECONFIG")

  # Only modify if the server points to the Freelens local proxy
  if [[ "$temp_server" =~ ^https://127\.0\.0\.1:[0-9]+/ ]]; then
    export REAL_SERVER REAL_USER
    REAL_SERVER=$(yq '.clusters[] | select(.name == env(CLUSTER_NAME)) | .cluster.server' ~/.kube/config)

    if [[ -n "$REAL_SERVER" && "$REAL_SERVER" != "null" ]]; then
      REAL_USER=$(yq '.contexts[] | select(.context.cluster == env(CLUSTER_NAME)) | .context.user' ~/.kube/config)

      # Replace server and remove Freelens proxy CA/TLS settings
      yq -i '
        .clusters[0].cluster.server = env(REAL_SERVER) |
        del(.clusters[0].cluster.certificate-authority-data) |
        del(.clusters[0].cluster.insecure-skip-tls-verify)
      ' "$KUBECONFIG"

      # Update context to reference the correct user
      yq -i '.contexts[0].context.user = env(REAL_USER)' "$KUBECONFIG"

      # Replace users section with the matching user from real config
      user_tmp=$(mktemp)
      yq '.users[] | select(.name == env(REAL_USER))' ~/.kube/config >"$user_tmp"
      yq -i ".users = [load(\"${user_tmp}\")]" "$KUBECONFIG"
      rm -f "$user_tmp"
    fi
  fi
fi

$REAL_KUBECTL "$@"

With Codex, I fixed the x509 TLS errors on my side:

#!/usr/bin/env bash

REAL_KUBECTL=/home/linuxbrew/.linuxbrew/bin/kubectl
REAL_KUBECONFIG="${REAL_KUBECONFIG:-$HOME/.kube/config}"

if [[ "${LENS_SESSION:-}" == "true" && -n "${KUBECONFIG:-}" && -f "$KUBECONFIG" && -f "$REAL_KUBECONFIG" ]]; then
  # Convert REAL_KUBECONFIG to an absolute path.
  # This is useful because yq load(...) is used below.
  REAL_KUBECONFIG_DIR="$(cd "$(dirname "$REAL_KUBECONFIG")" && pwd)"
  REAL_KUBECONFIG="$REAL_KUBECONFIG_DIR/$(basename "$REAL_KUBECONFIG")"
  export REAL_KUBECONFIG

  # Extract cluster name and server from the Freelens temp kubeconfig
  CLUSTER_NAME="$(yq -r '.clusters[0].name // ""' "$KUBECONFIG")"
  TEMP_SERVER="$(yq -r '.clusters[0].cluster.server // ""' "$KUBECONFIG")"

  export CLUSTER_NAME

  # Only modify if the server points to the Freelens local proxy
  if [[ -n "$CLUSTER_NAME" && "$TEMP_SERVER" =~ ^https://127\.0\.0\.1:[0-9]+/ ]]; then
    REAL_SERVER="$(
      yq -r '[.clusters[] | select(.name == strenv(CLUSTER_NAME)) | .cluster.server] | .[0] // ""' "$REAL_KUBECONFIG"
    )"

    REAL_USER="$(
      yq -r '[.contexts[] | select(.context.cluster == strenv(CLUSTER_NAME)) | .context.user] | .[0] // ""' "$REAL_KUBECONFIG"
    )"

    export REAL_USER

    USER_FOUND="$(
      yq -r '[.users[] | select(.name == strenv(REAL_USER))] | length > 0' "$REAL_KUBECONFIG"
    )"

    if [[ -n "$REAL_SERVER" && -n "$REAL_USER" && "$USER_FOUND" == "true" ]]; then
      # Replace the complete cluster config, not only the server.
      # This keeps certificate-authority-data, certificate-authority,
      # insecure-skip-tls-verify, proxy-url, tls-server-name, etc.
      yq -i '
        .clusters[0].cluster = (
          load(strenv(REAL_KUBECONFIG)).clusters[]
          | select(.name == strenv(CLUSTER_NAME))
          | .cluster
        ) |
        .contexts[0].context.user = strenv(REAL_USER) |
        .users = [
          load(strenv(REAL_KUBECONFIG)).users[]
          | select(.name == strenv(REAL_USER))
        ]
      ' "$KUBECONFIG"

      # If the real kubeconfig uses a relative certificate-authority file path,
      # make it absolute. Otherwise it may be resolved relative to the Freelens
      # temp kubeconfig location.
      CA_FILE="$(yq -r '.clusters[0].cluster."certificate-authority" // ""' "$KUBECONFIG")"

      if [[ -n "$CA_FILE" && "$CA_FILE" != /* ]]; then
        export CA_FILE="$REAL_KUBECONFIG_DIR/$CA_FILE"

        yq -i '
          .clusters[0].cluster."certificate-authority" = strenv(CA_FILE)
        ' "$KUBECONFIG"
      fi
    fi
  fi
fi

exec "$REAL_KUBECTL" "$@"

Great! I'm glad you figured it out.