<p>I am using the following version:</p>

<pre><code>Client Version: version.Info{Major:"1", Minor:"9", GitVersion:"v1.9.1", GitCommit:"3a1c9449a956b6026f075fa3134ff92f7d55f812", GitTreeState:"clean", BuildDate:"2018-01-04T11:52:23Z", GoVersion:"go1.9.2", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"9", GitVersion:"v1.9.1", GitCommit:"3a1c9449a956b6026f075fa3134ff92f7d55f812", GitTreeState:"clean", BuildDate:"2018-01-04T11:40:06Z", GoVersion:"go1.9.2", Compiler:"gc", Platform:"linux/amd64"}
</code></pre>

<p>Here, I am trying to authenticate a user that makes use of x509 certs using the below custom scrip that I created looking into few online forums and kubernetes docs. </p>

<pre><code>#!/bin/bash

cluster=test-operations-k8
namespace=demo
username=jack


openssl genrsa -out $username.pem 2048


openssl req -new -key $username.pem -out $username.csr -subj "/CN=$username"



cat &lt;&lt;EOF | kubectl create -n $namespace -f -
apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
  name: user-request-$username
spec:
  groups:
  - system:authenticated
  request: $(cat $username.csr | base64 | tr -d '\n')
  usages:
  - digital signature
  - key encipherment
  - server auth
EOF



kubectl certificate approve user-request-$username


kubectl get csr user-request-$username -o jsonpath='{.status.certificate}' | base64 -d &gt; $username.crt

kubectl --kubeconfig ~/.kube/config-$username config set-cluster $cluster --insecure-skip-tls-verify=true --server=https://$cluster.eastus.cloudapp.azure.com
kubectl --kubeconfig ~/.kube/config-$username config set-credentials $username --client-certificate=$username.crt --client-key=$username.pem --embed-certs=true
kubectl --kubeconfig ~/.kube/config-$username config set-context $cluster --cluster=$cluster --user=$username
kubectl --kubeconfig ~/.kube/config-$username config use-context $cluster

echo "Config file for $username has been created successfully !"
</code></pre>

<p>But while getting resources I get the below error:</p>

<pre><code>error: You must be logged in to the server (Unauthorized)
</code></pre>

<p>Can someone please advise what needs to be done to fix this issue ?</p>

<p>Also please note the appropriate roles and rolebindings have also been created which I have not listed out here.</p>

<p>Make sure the CA used to sign the CSRs (the <code>--cluster-signing-cert-file</code> file given to kube-controller-manager) is in the <code>--client-ca-file</code> bundle given to kube-apiserver (which is what authenticates client certs presented to the apiserver)</p>

<p>Also ensure the certificate requested is a client certificate (has <code>client auth</code> in the <code>usages</code> field)</p>
