<p>After certification renewal in K8 Cluster, we are getting permission error while running some kubectl commands. For example; we get this error while running the commands &quot;kubectl get deployments&quot; and &quot;kubectl get pv&quot;</p>
<p>&quot;<strong>Error from server (Forbidden): pods &quot;&lt;&gt;&quot; is forbidden: User &quot;system:node:&lt;&gt;&quot; cannot create resource &quot;pods/exec&quot; in API group &quot;&quot; in the namespace &quot;......&quot;</strong></p>
<p>But, we can able to run commands such as &quot;Kubectl get nodes&quot; and &quot;kubectl get pods&quot; without any issues.</p>
<p>During cert renewal process, we ran the below command and manually updated kubelet.conf in /etc/kubernetes and config file in /root/.kube directory.</p>
<p>Is there any other files, we need to update the new certificate related details ? Kindly help us with remediation process/steps at the earliest possible.</p>
<p>•   sudo kubeadm alpha kubeconfig user --org system:nodes --client-name system:node:$(hostname) &gt; kubelet.conf</p>
<p>Our Prod Kubernetes Cluster Information:</p>
<p>Kubernetes Cluster Version - 1.13.x
Master Node - 1
Worker Nodes - 11</p>
<p>Recently, the below mentioned certifications got renewed recently.</p>
<ul>
<li>apiserver.crt</li>
<li>apiserver-kubelet-client.crt</li>
<li>front-proxy-client.crt</li>
<li>apiserver-etcd-client.crt</li>
</ul>

Raja Subramaniam Mahali
<p>Apparently, you are using the kubelet certificate instead of that for the kubectl (admin cert).</p>
<p><strong>Try  running this command and see if it works:</strong></p>
<pre><code> sudo kubectl get pv --kubeconfig /etc/kubernetes/admin.conf
</code></pre>
<p><strong>If it does, do:</strong></p>
<pre><code> sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
 sudo chown $(id -u):$(id -g) $HOME/.kube/config
 kubectl get pv
 kubectl get deploy

 
</code></pre>
