<p>I've tried to create user accounts with a client certificate.</p>

<p>I followed two tutorials but stuck with both options in an error with the message</p>

<p><a href="https://medium.com/better-programming/k8s-tips-give-access-to-your-clusterwith-a-client-certificate-dfb3b71a76fe" rel="nofollow noreferrer">https://medium.com/better-programming/k8s-tips-give-access-to-your-clusterwith-a-client-certificate-dfb3b71a76fe</a></p>

<p><a href="https://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/" rel="nofollow noreferrer">https://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/</a></p>

<p>I set the right user, server and the right context. I set the namespace but still the same error.</p>

<pre><code>&gt; kubectl get pods
You must be logged in to the server (Unauthorized) 
</code></pre>

<p>Did someone already experienced something similar? Or does someone knows what i'm doing wrong?</p>

<p>My k3s cluster version is 1.15.4.</p>

<p>From the error you posted, your user is getting failed in Authentication phase only (HTTP error code: <strong>401</strong>), you can validate the same using:</p>

<pre><code>$ k get pods -v=6
...
I0123 16:34:18.842853   29373 helpers.go:203] server response object: [{
  ...
  "code": 401
}]
F0123 16:34:18.842907   29373 helpers.go:114] error: You must be logged in to the server (Unauthorized)
</code></pre>

<p>Debug your setup using below steps:</p>

<ol>
<li><p>Verify you are using the correct context and correct user as you expected (with * in CURRENT column):</p>

<pre><code>$ kubectl config get-contexts 
CURRENT   NAME                          CLUSTER      AUTHINFO                NAMESPACE
*         context-user-ca-signed        kubernetes   user-user-ca-signed     ns1
          kubernetes-admin@kubernetes   kubernetes   kubernetes-admin        
</code></pre></li>
<li><p>Verify the CA certificate for Kubernetes API Server (assuming API server running as a Pod):</p>

<pre><code>$ sudo cat /etc/kubernetes/manifests/kube-apiserver.yaml | grep -i "\-\-client-ca-file"
    - --client-ca-file=/etc/kubernetes/pki/ca.crt

$ openssl x509 -in /etc/kubernetes/pki/ca.crt -text -noout | grep -i "Issuer:\|Subject:"
        Issuer: CN = kubernetes
        Subject: CN = kubernetes
</code></pre></li>
<li><p>Verify your user's certificate is signed by above CA (Issuer CN of user's cert is same as Subject CN of CA cert, "kubernetes" here), which is configured in API server:</p>

<pre><code>$ kubectl config view --raw -o jsonpath="{.users[?(@.name == \"user-user-ca-signed\")].user.client-certificate-data}" | base64 -d &gt; client.crt

$ openssl x509 -in client.crt -text -noout | grep -i "Issuer:\|Subject:"
        Issuer: CN = kubernetes
        Subject: C = IN, ST = Some-State, O = Some-Organization, CN = user-ca-signed
</code></pre></li>
</ol>

<p>If the above steps are fine for the user you created, you shall pass <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/" rel="nofollow noreferrer">Authentication</a> phase.
But <a href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/" rel="nofollow noreferrer">Authorization</a> phase still needs to be configured using RBAC, ABAC or any other supported authorization mode, else you may still get HTTP error code: <strong>403</strong></p>

<pre><code>$ kubectl get pods -v=6
I0123 16:59:41.350501   28553 helpers.go:203] server response object: [{
  ...
  "code": 403
}]
F0123 16:59:41.351080   28553 helpers.go:114] Error from server (Forbidden): pods is forbidden: User "user-ca-signed" cannot list resource "pods" in API group "" in the namespace "ns1": No policy matched.
</code></pre>
