<p>I am running kube on a cluster of nodes. When i set the context on the cluster I get an error that says "error: You must be logged in to the server (Unauthorized)" when i try to run kubectl get pods </p>

<p>If I unset the current-context the error goes away and i can view my pods and nodes. So my guess is it has something to do with my kubeconfig but I'm not sure where i got it wrong.</p>

<pre><code>apiVersion: v1
clusters:
- cluster:
    certificate-authority: /home/user/ssl/ca.pem
    server: https://&lt;ip for my master node&gt;
  name: default-cluster
contexts:
- context:
    cluster: default-cluster
    user: user
  name: kubeflow
current-context: kubeflow
kind: Config
preferences: {}
users:
- name: user
  user:
    client-certificate: /home/user/ssl/client-ca.pem
    client-key: /home/user/ssl/client-ca-key.pem

</code></pre>

<p>EDIT: </p>

<p>Kube version 1.14</p>

<pre><code>user@kube01:~$ kubectl  version
Client Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.1", GitCommit:"b7394102d6ef778017f2ca4046abbaa23b88c290", GitTreeState:"clean", BuildDate:"2019-04-08T17:11:31Z", GoVersion:"go1.12.1", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.1", GitCommit:"b7394102d6ef778017f2ca4046abbaa23b88c290", GitTreeState:"clean", BuildDate:"2019-04-08T17:02:58Z", GoVersion:"go1.12.1", Compiler:"gc", Platform:"linux/amd64"}
</code></pre>

<ul>
<li>Running on a cluster with 3 master nodes and 4 workers.
Not on GCP or any cloud platform </li>
</ul>

Chirrut Imwe
<blockquote>
  <p>If I unset the current-context the error goes away and i can view my pods and nodes. So my guess is it has something to do with my kubeconfig but I'm not sure where i got it wrong.</p>
</blockquote>

<p>That very likely means you are running <code>kubectl</code> on the master nodes themselves, and the master nodes are listening on <code>:8080</code> with the unauthenticated port (since <code>kubectl</code> uses <code>http://127.0.0.1:8080</code> by default if there is no kubeconfig)</p>

<p>So yes, it's very likely due to your cert being signed by a CA that the apiserver does not trust.</p>

<p>You can check that via:</p>

<pre><code>openssl x509 -in /home/user/ssl/client-ca.pem -noout -text
</code></pre>

<p>and then look at the CA and compare the <code>issuer</code> from your <code>client-ca</code> against the <code>subject</code> of your CA:</p>

<pre><code>openssl x509 -in /home/user/ssl/ca.pem -noout -text
</code></pre>

<p>I am sure there are some fingerprints and serial numbers and that kind of stuff that need to match up, but I don't have that <code>openssl</code> command line handy</p>
