<p>I am creating a new user in my kubeadm kubernetes cluster named tote. so first I created a key:</p>
<pre><code>openssl genrsa -out tote.key 2048
</code></pre>
<p>Then I created a CSR:</p>
<pre><code>openssl req -new -key tote.key -subj &quot;/CN=tote-admin&quot; -out tote.csr
</code></pre>
<p>Finally, I am following kubernetes docs <a href="https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/" rel="nofollow noreferrer">in here</a> so:</p>
<p>A) I create a certificate signing request manifest:</p>
<pre><code>apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: tote
spec:
  request: XXXXXX (based64 of the generated CSR)
  signerName: kubernetes.io/kube-apiserver-client
  usages:
  - client auth
</code></pre>
<p>B) Approve the CSR using kubectl:</p>
<pre><code>kubectl certificate approve tote
</code></pre>
<p>C) Produce the crt certificate for tote user:</p>
<pre><code>kubectl get csr tote -o jsonpath='{.status.certificate}'| base64 -d &gt; tote.crt
</code></pre>
<p>Finally, when trying to list pods using apiserver url using tote user, it gives me error as the following:</p>
<pre><code>curl https://172.31.127.100:6443/api/v1/pods --key tote.key --cert tote.crt --cacert /etc/kubernetes/pki/ca.crt
</code></pre>
<p>And the response:</p>
<pre><code>{
  &quot;kind&quot;: &quot;Status&quot;,
  &quot;apiVersion&quot;: &quot;v1&quot;,
  &quot;metadata&quot;: {},
  &quot;status&quot;: &quot;Failure&quot;,
  &quot;message&quot;: &quot;pods is forbidden: User \&quot;tote-admin\&quot; cannot list resource \&quot;pods\&quot; in API group \&quot;\&quot; at the cluster scope&quot;,
  &quot;reason&quot;: &quot;Forbidden&quot;,
  &quot;details&quot;: {
    &quot;kind&quot;: &quot;pods&quot;
  },
  &quot;code&quot;: 403
</code></pre>
<p>Any help how to resolve this issue and allow user tote to access pods?</p>

Khaled
<ol>
<li><p>Looks your Auth working, but user doesn't have the necessary permissions. You need to create RBAC permissions for the user you use. Refer to <a href="https://Kubernetes.io/doc/reference/access-auth-authz/rbac/" rel="nofollow noreferrer">Using RBAC Authorization</a></p>
</li>
<li><p>And also try capturing certs from the .kube/config file.
Like client-key data :</p>
<p>echo -n &quot;LS0....Cg==&quot; | base64 -d &gt; admin.key</p>
</li>
</ol>
<p>Client-certificate-data :</p>
<pre><code>echo -n &quot;LS0...C==&quot; | base64 -d &gt; admin.crt 
</code></pre>
<p>Certificate authority-data :</p>
<pre><code>echo -n &quot;LS0...g==&quot; | base64 -d &gt;ca.crt 
</code></pre>
<p>Then use, <code>curl https://172.31.127.100:6443 \  --key admin.key \ --cert admin.crt  --cacert can.crt</code></p>
