Unauthorized: The API server could not establish who is making the request

error: You must be logged in to the server (Unauthorized) is an authentication failure, not a permissions one. The credential is missing, malformed, or expired — RBAC was never consulted.

Applies to: All Kubernetes versions

What it means

Every request to the API server is authenticated before it is authorized. A 401 means the first stage failed: no valid credential was presented, so the server has no identity to evaluate rules against. This is a meaningfully different problem from Forbidden, and adding RBAC rules will not help at all. The usual causes are an expired credential, a kubeconfig pointing at the right cluster with the wrong or stale authentication data, an exec credential plugin that failed silently, or a ServiceAccount token that has expired — which became more common once projected tokens with expiry replaced long-lived secret-based ones.

Most common causes

• An expired client certificate in the kubeconfig.
• An expired or invalid bearer token.
• A cloud provider exec credential plugin that failed or produced no token.
• A kubeconfig context pointing at a cluster whose credentials have been rotated.
• A ServiceAccount's projected token expiring in a long-running client that does not reload it from disk.
• The cluster's certificate authority having been replaced, making existing client certificates invalid.
• System clock skew large enough that a token appears not yet valid or already expired.

How to diagnose it

1. Check which context and user are in use: kubectl config current-context and kubectl config view --minify.
2. For a certificate, check its validity dates by decoding it — an expired notAfter is definitive.
3. For an exec plugin, run its command manually and see whether it produces a token.
4. For an in-cluster client, confirm the token file is being re-read: a projected token is rotated on disk and a client that read it once at startup will eventually fail.
5. Check the API server's audit or authentication logs if you have access, which record why the credential was rejected.
6. Compare the clock on the client and the cluster.

How to fix it

1. Renew the credential — re-run the cloud provider's login command, or issue a new client certificate.
2. Update the kubeconfig to match the cluster's current authentication configuration.
3. Make in-cluster clients reload the token from its file rather than caching it. Official client libraries do this; hand-rolled HTTP clients often do not.
4. Correct clock skew on the client.
5. Confirm the ServiceAccount still exists — deleting and recreating it invalidates tokens issued to the old one.

Notes

The distinction between 401 and 403 is worth internalising, because the fixes share nothing. Unauthorized means the server does not know who you are. Forbidden means it knows exactly who you are and is refusing.

Related

• Error from server (Forbidden) — RBAC denied the request
• x509: certificate signed by unknown authority — The client does not trust the server's certificate

Sources

• Kubernetes documentation — Authenticating
• Kubernetes documentation — Managing Service Accounts
• Kubernetes documentation — Certificate Signing Requests