title: kubernetes - can't access the cluster with new user certificate
body: <p>I want to create new user admin in kubernetes ,i do all the steps for creating and authorizing the certificates but when i want to access to api,i receive anuthorized error.
  i do these steps to create user-admin:</p>
  
  <p>1/ <code>openssl genrsa -out user.key 2048</code></p>
  
  <p>2/ <code>openssl req -new -key user.key -out user.csr -subj "/CN=kube-user"</code></p>
  
  <p>3/</p>
  
  <pre><code>cat &lt;&lt;EOF | kubectl apply -f -
  apiVersion: certificates.k8s.io/v1beta1
  kind: CertificateSigningRequest
  metadata:
    name: user
  spec:
    request: $(cat user.csr | base64 | tr -d '\n')
    usages:
    - digital signature
    - key encipherment
    - server auth
  EOF
  </code></pre>
  
  <p>4/ <code>k certificate approve user</code></p>
  
  <p>5/ <code>k get csr user -o jsonpath='{.status.certificate}' | base64 --decode &gt; user.crt</code></p>
  
  <p>6/ <code>kubectl config view -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' --raw | base64 --decode - &gt; ca.crt</code></p>
  
  <p>7/ </p>
  
  <pre><code>curl https://$Kube-Master-Ip:6443/api/v1 \
   --key user.key \
   --cert user.crt \
   --cacert ca.crt
  </code></pre>
  
  <p>8/ and this is what i've receive:</p>
  
  <pre><code>{
  "kind":"Status",
  "apiVersion":"v1",
  "metadata":{},
  "status":"Failure",
  "message":"Unauthorized",
  "reason":"Unatuhorized",
  "code":401
  }
  </code></pre>
  
  <blockquote>
    <blockquote>
      <p>document source: <a href="https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/</a></p>
    </blockquote>
  </blockquote>