<p>I was trying to run <code>curl -v -L --cacert cert.crt --key cert.key -k --request GET &quot;https://*my-k8s-server-ip:port*/api/v1/namespaces/testing/services&quot;</code>, it is showing me the following error:</p>
<pre><code>{
  &quot;kind&quot;: &quot;Status&quot;,
  &quot;apiVersion&quot;: &quot;v1&quot;,
  &quot;metadata&quot;: {

  },
  &quot;status&quot;: &quot;Failure&quot;,
  &quot;message&quot;: &quot;services is forbidden: User \&quot;system:anonymous\&quot; cannot list resource \&quot;services\&quot; in API group \&quot;\&quot; in the namespace \&quot;testing\&quot;&quot;,
  &quot;reason&quot;: &quot;Forbidden&quot;,
  &quot;details&quot;: {
    &quot;kind&quot;: &quot;services&quot;
  },
  &quot;code&quot;: 403
}* Connection #0 to host *my-k8s-server-ip* left intact
</code></pre>
<p>but when I tried with Postman providing the cert and key, it works perfectly fine.
Please help.</p>

doremi666
<p>Kubernetes API Server could not recognize the user in this case which makes it default to <code>system:anonymous</code> user.</p>
<p>You need to provide a client certificate using <code>--cert</code> parameter which should have the user in CNAME(subject: CN)</p>
<p><code>curl -v -L --cacert cert.crt --key cert.key --cert client.crt -k --request GET &quot;https://*my-k8s-server-ip:port*/api/v1/namespaces/testing/services</code>&quot;</p>
<p>As an alternative you can use the token from a service account as BEARER token as documented <a href="https://kubernetes.io/docs/tasks/administer-cluster/access-cluster-api/#without-kubectl-proxy" rel="nofollow noreferrer">here</a></p>
