<p>Kubernetes version : v1.19.0</p>
<p>I have created a user and performed clusterrolebinding with a role cluster-admin.</p>
<pre><code>[root@project1-master ~]# kubectl describe clusterrole cluster-admin
Name:         cluster-admin
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
PolicyRule:
  Resources  Non-Resource URLs  Resource Names  Verbs
  ---------  -----------------  --------------  -----
  *.*        []                 []              [*]
             [*]                []              [*]

[root@project1-master ~]# kubectl describe clusterrolebinding sajeesh  cluster-admin
Name:         sajeesh
Labels:       &lt;none&gt;
Annotations:  &lt;none&gt;
Role:
  Kind:  ClusterRole
  Name:  cluster-admin
Subjects:
  Kind  Name     Namespace
  ----  ----     ---------
  User  sajeesh


Name:         cluster-admin
Labels:       kubernetes.io/bootstrapping=rbac-defaults
Annotations:  rbac.authorization.kubernetes.io/autoupdate: true
Role:
  Kind:  ClusterRole
  Name:  cluster-admin
Subjects:
  Kind   Name            Namespace
  ----   ----            ---------
  Group  system:masters
</code></pre>
<blockquote>
<blockquote>
<p>I am able to run kubectl with this useraccount and get pods information :</p>
</blockquote>
</blockquote>
<pre><code>[root@project1-master ~]# kubectl get pods --as sajeesh
NAME    READY   STATUS    RESTARTS   AGE
busyb   1/1     Running   3          21h
</code></pre>
<blockquote>
<blockquote>
<p>But when i try to access kube-apiserver using curl it show forbidden error as following :</p>
</blockquote>
</blockquote>
<pre><code>[root@project1-master ~]# curl --cacert /etc/kubernetes/pki/ca.crt --cert sajeesh.crt --key sajeesh.key https://$IP:6443/api/v1/namespaces/default/pods/busyb
{
  &quot;kind&quot;: &quot;Status&quot;,
  &quot;apiVersion&quot;: &quot;v1&quot;,
  &quot;metadata&quot;: {

  },
  &quot;status&quot;: &quot;Failure&quot;,
  &quot;message&quot;: &quot;pods \&quot;busyb\&quot; is forbidden: User \&quot;system:anonymous\&quot; cannot get resource \&quot;pods\&quot; in API group \&quot;\&quot; in the namespace \&quot;default\&quot;&quot;,
  &quot;reason&quot;: &quot;Forbidden&quot;,
  &quot;details&quot;: {
    &quot;name&quot;: &quot;busyb&quot;,
    &quot;kind&quot;: &quot;pods&quot;
  },
  &quot;code&quot;: 403
</code></pre>
<blockquote>
<blockquote>
<p>I have re-verified the cacert , cert &amp; key i am providing with that user account .They are correct.</p>
</blockquote>
</blockquote>
<blockquote>
<blockquote>
<p>Any suggestions why this is happening and how to fix it.</p>
</blockquote>
</blockquote>

confused genius
<p>finally managed to findout the problem.it is not related to kubernetes but with curl command i am using .</p>
<pre><code>curl --cacert /etc/kubernetes/pki/ca.crt --cert sajeesh.crt --key sajeesh.key https://$IP:6443/api/v1/namespaces/default/pods/busyb 
</code></pre>
<p>when i used -v switch along with command , It showed :</p>
<pre><code>* Initializing NSS with certpath: sql:/etc/pki/nssdb
*   CAfile: /etc/kubernetes/pki/ca.crt
  CApath: none
* warning: certificate file name &quot;sajeesh.crt&quot; handled as nickname; please use &quot;./sajeesh.crt&quot; to force file name
* NSS: client certificate not found: newsajeesh.crt
* SSL connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
</code></pre>
<p>So basically it was looking for absolute path as input for arguments --cert &amp; --key</p>
<pre><code>curl --cacert /etc/kubernetes/pki/ca.crt --cert ./sajeesh.crt --key ./sajeesh.key https://$IP:6443/api/v1/namespaces/default/pods/busyb 
</code></pre>
<p>after giving  the absolute path it worked fine and i am able to get the output.</p>
