<p>[xueke@master-01 admin]$ kubectl logs nginx-deployment-76bf4969df-999x8
    Error from server (Forbidden): Forbidden (user=system:anonymous, verb=get, resource=nodes, subresource=proxy) ( pods/log nginx-deployment-76bf4969df-999x8)</p>

<pre><code>[xueke@master-01 admin]$ kubectl config view
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://192.168.0.101:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: admin
  name: kubernetes
current-context: kubernetes
kind: Config
preferences: {}
users:
- name: admin
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED
</code></pre>

<p>I specified the admin user here
How do I need to modify it?</p>

<p>The above error means your apiserver doesn't have the credentials (<code>kubelet cert and key</code>) to authenticate the kubelet's log/exec commands and hence the <code>Forbidden</code> error message.</p>
<p>You need to provide <code>--kubelet-client-certificate=&lt;path_to_cert&gt;</code> and <code>--kubelet-client-key=&lt;path_to_key&gt;</code> to your apiserver, this way apiserver authenticate the kubelet with the certficate and key pair.</p>
<p>For more information, have a look at:</p>
<p><a href="https://kubernetes.io/docs/reference/access-authn-authz/kubelet-authn-authz/" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/kubelet-authn-authz/</a></p>
