<p>I want to create new user admin in kubernetes ,i do all the steps for creating and authorizing the certificates but when i want to access to api,i receive anuthorized error.
i do these steps to create user-admin:</p>

<p>1/ <code>openssl genrsa -out user.key 2048</code></p>

<p>2/ <code>openssl req -new -key user.key -out user.csr -subj "/CN=kube-user"</code></p>

<p>3/</p>

<pre><code>cat &lt;&lt;EOF | kubectl apply -f -
apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
  name: user
spec:
  request: $(cat user.csr | base64 | tr -d '\n')
  usages:
  - digital signature
  - key encipherment
  - server auth
EOF
</code></pre>

<p>4/ <code>k certificate approve user</code></p>

<p>5/ <code>k get csr user -o jsonpath='{.status.certificate}' | base64 --decode &gt; user.crt</code></p>

<p>6/ <code>kubectl config view -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' --raw | base64 --decode - &gt; ca.crt</code></p>

<p>7/ </p>

<pre><code>curl https://$Kube-Master-Ip:6443/api/v1 \
 --key user.key \
 --cert user.crt \
 --cacert ca.crt
</code></pre>

<p>8/ and this is what i've receive:</p>

<pre><code>{
"kind":"Status",
"apiVersion":"v1",
"metadata":{},
"status":"Failure",
"message":"Unauthorized",
"reason":"Unatuhorized",
"code":401
}
</code></pre>

<blockquote>
  <blockquote>
    <p>document source: <a href="https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/</a></p>
  </blockquote>
</blockquote>

Sajjad Hadafi
<p>The step 2 command is wrong. The admin user should be part of system:masters group.</p>

<pre><code>openssl req -new -key user.key -out user.csr -subj "/CN=kube-user/O=system:masters"
</code></pre>
