I have faced the similar issue today and the above comments helped me to fix the issue. I am adding more details with my scenario because it might be helpful for the people which have similar settings.
I have a separate user for connecting to my k8s cluster (It's a normal cluster in EC2 instances). I had created the user arunlal with limited access by adding ClusterRoleBindings.
If you get the following error while running API to cluster (in my case Kubectl):
error: You must be logged in to the server (Unauthorized)
Go through the following order.
- First check the cert used in your config file (local client)
I had a separate configuration on my local system, because the main config had the details about the other k8s & okd cluster credentials. So I had created second configuration on my Laptop (/Users/arunlal/.kube/config_two). In this case I have the following aliases:
alias kctl="kubectl --kubeconfig=/Users/arunlal/.kube/config_two"
- From this file you will get the cert that we are using.
[firstname.lastname@example.org ~] cat /Users/arunlal/.kube/config_two| grep -A 5 users
- name: arunlal
- Once you get the cert in your client configuration you can check the validity using the openssl command.
[email@example.com ~] openssl x509 -noout -dates -in /Users/arunlal/.arunlal-keys/arunlal.crt
notBefore=Jun 22 23:43:22 2021 GMT
notAfter=Sep 30 23:43:22 2021 GMT
- Validate the expiry
While creating the user I passed the days as 5, that was the issue. How I created user?
openssl genrsa -out arunlal.key 2048
openssl req -new -key arunlal.key -out arunlal.csr -subj "/CN=arunlal/O=crybit"
openssl x509 -req -in arunlal.csr -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out arunlal.crt -days 5
kubectl config set-credentials arunlal --client-certificate=/root/arunlal-keys/arunlal.crt --client-key=/root/arunlal-keys/arunlal.key
- To fix, I recreated the cert with more number of days
openssl x509 -req -in arunlal.csr -CA /etc/kubernetes/pki/ca.crt
-CAkey /etc/kubernetes/pki/ca.key -CAcreateserial -out arunlal.crt -days 100
- This we need to run from the k8s cluster.
- Replaced the cert locally.
Modified /Users/arunlal/.arunlal-keys/arunlal.crt with new cert.
Hope this will help someone. Thanks!