Add Worker Node to Kubespray Cluster
As the error message suggests you are being denied permission to access the certificates Kubespray needs to scale the cluster, specifically it needs the Certificate Authority (CA) to generate a certificate for the new node.
Ensure that you have the correct file permissions to read the certificates for the CA and for the control plane node (ca.pem and node-kubespray-master-0-key.pem) and that you have correctly configured your SSLDIR variable to the path storing your cluster's certificates.