<p>I have a kubeadm cluster. I modified the <code>.kube/config</code> file by exporting out hardcoded <code>certificate-authority-data</code> value (the base64 of ca certificate) to another file called <code>ca.b64.crt</code>. I modified also the <code>client-certificate</code> and <code>client-key</code> by having their values in another files in the disk.</p>
<p>So the result <code>.kube/config</code> file is:</p>
<pre><code>apiVersion: v1
clusters:
- cluster:
    certificate-authority: /etc/kubernetes/pki/ca.b64.crt
    server: https://172.31.127.100:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate: /etc/kubernetes/pki/admins/admin.b64.crt
    client-key: /etc/kubernetes/pki/admins/admin.b64.key
</code></pre>
<p>The problem is that whenever I try to use kubectl (e.g to get pods), I got:</p>
<pre><code>xxxx:~$ k get po
error: unable to load root certificates: unable to parse bytes as PEM block
</code></pre>
<p>Any ideas?</p>

Khaled
<p><strong>Below troubleshooting steps will help you resolve issues related to the format or content of the certificate files</strong></p>
<p>1.Check to see if the certificate files are at the expected locations.</p>
<p>2.Check that the certificate and key files are in the correct format, particularly PEM.</p>
<p>3.Check that the certificate and key files are read-only for the user using the 'kubectl' command.</p>
<p>4.Try with enhanced privileges like ‘sudo kubectl'.</p>
<p>Refer to the <a href="https://kodekloud.com/blog/certified-kubernetes-administrator-exam-security/#:%7E:text=kubectl%20get%20serviceaccount-,Introduction%20to%20TLS,-Transport%20Layer%20Security" rel="nofollow noreferrer">doc</a> Introduction to TLS written by Mumshad Mannambeth for more information.</p>
<p>The error  “Unable to load  root certificate” seems like if we paste the cert from a browser.It is most likely that we may miss the  CR and LF characters by not reading/loading the cert file.</p>
<p>you can use something like <a href="https://www.base64encode.org/" rel="nofollow noreferrer">https://www.base64encode.org/</a>. Simply insert the PEM data and encode!</p>
