<p>Kubernetes version : v1.19.0</p>
<p>I have created a user and performed clusterrolebinding with a role cluster-admin.</p>
<pre><code>[root@project1-master ~]# kubectl describe clusterrole cluster-admin
Name:         cluster-admin
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
PolicyRule:
  Resources  Non-Resource URLs  Resource Names  Verbs
  ---------  -----------------  --------------  -----
  *.*        []                 []              [*]
             [*]                []              [*]

[root@project1-master ~]# kubectl describe clusterrolebinding sajeesh  cluster-admin
Name:         sajeesh
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;
Role:
  Kind:  ClusterRole
  Name:  cluster-admin
Subjects:
  Kind  Name     Namespace
  ----  ----     ---------
  User  sajeesh


Name:         cluster-admin
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
Role:
  Kind:  ClusterRole
  Name:  cluster-admin
Subjects:
  Kind   Name            Namespace
  ----   ----            ---------
  Group  system:masters
</code></pre>
<blockquote>
<blockquote>
<p>I am able to run kubectl with this useraccount and get pods information :</p>
</blockquote>
</blockquote>
<pre><code>[root@project1-master ~]# kubectl get pods --as sajeesh
NAME    READY   STATUS    RESTARTS   AGE
busyb   1/1     Running   3          21h
</code></pre>
<blockquote>
<blockquote>
<p>But when i try to access kube-apiserver using curl it show forbidden error as following :</p>
</blockquote>
</blockquote>
<pre><code>[root@project1-master ~]# curl --cacert /etc/kubernetes/pki/ca.crt --cert sajeesh.crt --key sajeesh.key https://$IP:6443/api/v1/namespaces/default/pods/busyb
{
  &quot;kind&quot;: &quot;Status&quot;,
  &quot;apiVersion&quot;: &quot;v1&quot;,
  &quot;metadata&quot;: {

  },
  &quot;status&quot;: &quot;Failure&quot;,
  &quot;message&quot;: &quot;pods \&quot;busyb\&quot; is forbidden: User \&quot;system:anonymous\&quot; cannot get resource \&quot;pods\&quot; in API group \&quot;\&quot; in the namespace \&quot;default\&quot;&quot;,
  &quot;reason&quot;: &quot;Forbidden&quot;,
  &quot;details&quot;: {
    &quot;name&quot;: &quot;busyb&quot;,
    &quot;kind&quot;: &quot;pods&quot;
  },
  &quot;code&quot;: 403
</code></pre>
<blockquote>
<blockquote>
<p>I have re-verified the cacert , cert &amp; key i am providing with that user account .They are correct.</p>
</blockquote>
</blockquote>
<blockquote>
<blockquote>
<p>Any suggestions why this is happening and how to fix it.</p>
</blockquote>
</blockquote>

<p>The clusterrolebinding <code>sajeesh</code> has name <code>sajeesh</code> and Group <code>system:masters</code>.Hence the certificate need to have <code>sajeesh</code> as Common Name(CN) and   <code>system:masters</code> as Organization(O). When the request goes to kubernetes API server it will inspect the certificate and match <code>CN</code> with <code>name</code> and <code>O</code> with <code>Group</code> in <code>clusterrolebinding</code> and if it does not match you get <code>403 Forbidden</code> error.</p>
<p>You can verify above by running below command</p>
<pre><code>openssl x509 -in sajeesh.crt -text -noout
</code></pre>
