<p>I used <a href="https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/" rel="nofollow noreferrer">Kubernetes document</a> to create a request for user certificate via API-server.  </p>

<pre><code>cat &lt;&lt;EOF | kubectl apply -f -
apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
  name: myuser
spec:
  request: $(cat server.csr | base64 | tr -d '\n')
  usages:
  - digital signature
  - key encipherment
  - server auth
EOF
</code></pre>

<p>I generated the certificate, created the kubeconfig file and created the necessary role/rolebindings successfully. However, when I try to access the cluster, I get the below error. I am quite sure that the issue is with the above yaml definition; but could not figure out.</p>

<pre><code>users error: You must be logged in to the server (Unauthorized)
</code></pre>

<p>Any idea please?</p>

<p>Seems, the issue is with the "spec" part. It is user authentication not server authentication. Hence, "server auth" should be client auth.</p>

<pre><code>spec:
  request: $(cat server.csr | base64 | tr -d '\n')
  usages:
  - digital signature
  - key encipherment
  - client auth
</code></pre>
