<p>I was using our Kubernetes cluster, I don't think so i have changed recently after deployment but am encountering this error</p>
<p><strong>Error kubectl log with verbose :</strong></p>
<pre><code>01:49:42.691510   30028 round_trippers.go:444] Response Headers:
I0514 01:49:42.691526   30028 round_trippers.go:447]     Content-Length: 12
10514 01:49:42.691537   30028 round_trippers.go:447]     Content-Type: text/plain; charset=utf-8
                                                            I0514 01:49:42.691545   30028 round_trippers.go:447]     Date: Tue, 14 May 2019 08:49:42 GMT
                                                                                                                                                        F0514 01:49:42.691976   30028 helpers.go:119] error: unable to upgrade connection: 
 Unauthorized


</code></pre>
<p><strong>Kubelet running with below options :</strong></p>
<pre><code>/usr/local/bin/kubelet --logtostderr=true --v=2 --address=0.0.0.0 --node-ip=1******
--hostname-override=***** --allow-privileged=true --bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf --authentication-token-webhook --enforce-node-allocatable= --client-ca-file=/etc/kubernetes/ssl/ca.crt --pod-manifest-path=/etc/kubernetes/manifests --pod-infra-container-image=gcr.io/google_containers/pause-amd64:3.1 --node-status-update-frequency=10s --cgroup-driver=cgroupfs --max-pods=110 --anonymous-auth=false --read-only-port=0 --fail-swap-on=True --runtime-cgroups=/systemd/system.slice --kubelet-cgroups=/systemd/system.slice --cluster-dns=10.233.0.3 --cluster-domain=cluster.local --resolv-conf=/etc/resolv.conf --kube-reserved cpu=200m,memory=512M --node-labels=node-role.kubernetes.io/master=,node-role.kubernetes.io/node= --network-plugin=cni --cni-conf-dir=/etc/cni/net.d --cni-bin-dir=/opt/cni/bin
</code></pre>
<p><em><strong>API running with below options :</strong></em></p>
<pre><code>kube-apiserver --allow-privileged=true --apiserver-count=2 --authorization-mode=Node,RBAC --bind-address=0.0.0.0 --endpoint-reconciler-type=lease --insecure-port=0 --kubelet-preferred-address-types=InternalDNS,InternalIP,Hostname,ExternalDNS,ExternalIP --runtime-config=admissionregistration.k8s.io/v1alpha1 --service-node-port-range=30000-32767 --storage-backend=etcd3 --advertise-address=******* --client-ca-file=/etc/kubernetes/ssl/ca.crt --enable-admission-plugins=NodeRestriction --enable-bootstrap-token-auth=true --etcd-cafile=/etc/kubernetes/ssl/etcd/ca.pem --etcd-certfile=/etc/kubernetes/ssl/etcd/node-bg-kub-dev-1.pem --etcd-keyfile=/etc/kubernetes/ssl/etcd/node-bg-kub-dev-1-key.pem --etcd-servers=https://*******:2379,https://********:2379,https://*****:2379 --kubelet-client-certificate=/etc/kubernetes/ssl/apiserver-kubelet-client.crt --kubelet-client-key=/etc/kubernetes/ssl/apiserver-kubelet-client.key --proxy-client-cert-file=/etc/kubernetes/ssl/front-proxy-client.crt --proxy-client-key-file=/etc/kubernetes/ssl/front-proxy-client.key --requestheader-allowed-names=front-proxy-client --requestheader-client-ca-file=/etc/kubernetes/ssl/front-proxy-ca.crt --requestheader-extra-headers-prefix=X-Remote-Extra- --requestheader-group-headers=X-Remote-Group --requestheader-username-headers=X-Remote-User --secure-port=6443 --service-account-key-file=/etc/kubernetes/ssl/sa.pub --service-cluster-ip-range=10.233.0.0/18 --tls-cert-file=/etc/kubernetes/ssl/apiserver.crt --tls-private-key-file=/etc/kubernetes/ssl/apiserver.key
</code></pre>

root
<p>I think you messed your cert files or you played with RBAC profiles.</p>

<p>You can have a look at great guide by Kelsey Hightower called <a href="https://github.com/kelseyhightower/kubernetes-the-hard-way" rel="nofollow noreferrer">kubernetes-the-hard-way</a>.</p>

<p>It's showing how to setup a whole cluster from beggining without any automation tools like kubeadm.</p>

<p>In part <a href="https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/04-certificate-authority.md" rel="nofollow noreferrer" title="04-certificate-authority.md">04-certificate-authority - Provisioning a CA and Generating TLS Certificates</a>.
You have exampled of certs being used in Kubernetes.</p>

<blockquote>
  <h3>The Kubelet Client Certificates</h3>
  
  <p>Kubernetes uses a  <a href="https://kubernetes.io/docs/admin/authorization/node/" rel="nofollow noreferrer">special-purpose authorization mode</a>  called Node Authorizer, that specifically authorizes API requests made by  <a href="https://kubernetes.io/docs/concepts/overview/components/#kubelet" rel="nofollow noreferrer">Kubelets</a>. In order to be authorized by the Node Authorizer, Kubelets must use a credential that identifies them as being in the  <code>system:nodes</code>  group, with a username of  <code>system:node:&lt;nodeName&gt;</code>. In this section you will create a certificate for each Kubernetes worker node that meets the Node Authorizer requirements.</p>
</blockquote>

<p>Once certs are generated for workers and uploaded you need to generate kubeconfig for each worker.</p>

<blockquote>
  <h3>The kubelet Kubernetes Configuration File</h3>
  
  <p>When generating kubeconfig files for Kubelets the client certificate matching the Kubelet's node name must be used. This will ensure Kubelets are properly authorized by the Kubernetes  <a href="https://kubernetes.io/docs/admin/authorization/node/" rel="nofollow noreferrer">Node Authorizer</a>.</p>
</blockquote>

<p>Also this case might be helpful <a href="https://stackoverflow.com/questions/44541723/kubectl-exec-results-in-error-unable-to-upgrade-connection-unauthorized">&quot;kubectl exec&quot; results in &quot;error: unable to upgrade connection: Unauthorized&quot;</a></p>
