I deployed apiserver using TLS on master node and it worked fine,my question appeared when I deploying the kubelet and tring to communicate with apiserver. the kubelet conf as follows:

/opt/bin/kubelet \
  --logtostderr=true \
  --v=0 \
  --api_servers=https://kube-master:6443 \
  --address=0.0.0.0 \
  --port=10250 \
  --allow-privileged=false \
  --tls-cert-file="/var/run/kubernetes/kubelet_client.crt" \
  --tls-private-key-file="/var/run/kubernetes/kubelet_client.key"
  --kubeconfig="/var/lib/kubelet/kubeconfig"

/var/lib/kubelet/kubeconfig is following:

apiVersion: v1
kind: Config
users:
- name: kubelet
  user:
    client-certificate: /var/run/kubernetes/kubelet_client.crt
    client-key: /var/run/kubernetes/kubelet_client.key
clusters:
- name: kube-cluster
  cluster:
    certificate-authority: /var/run/kubernetes/ca.crt
contexts:
- context:
    cluster: kube-cluster
    user: kubelet
  name: ctx-kube-system
current-context: ctx-kube-system

As I want to achieve the comunication using a two-way(both client and server)CA authentication and expect for a fluky reply,but apiserver ask me to provide my username and password which I have never used before,some command lines as following:

> kubectl version
> Client Version: version.Info{Major:"1", Minor:"3", GitVersion:"v1.3.2", GitCommit:"9bafa3400a77c14ee50782bb05f9efc5c91b3185", GitTreeState:"clean", BuildDate:"2016-07-17T18:30:39Z", GoVersion:"go1.6.2", Compiler:"gc", Platform:"linux/amd64"}
> Please enter Username: kubelet
> Please enter Password: kubelet
> error: You must be logged in to the server (the server has asked for the client to provide credentials)

I tried all these on master minion.Could anyone please resolve this conundrum？Thanks in advance.