Question

Kubernetes: How do I access the CA to sign a new user certificate?

I’m going through a RBAC tutorial for Kubernetes and have hit a roadblock. It looks like I need to sign user certs using Kubernetes’s CA. Since I can’t seem to access the master node, is there a way for me to access the CA or at least just sign new user cert requests with it?


Submit an answer


This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Accepted Answer

Hi

Yes you can use the build in CA in your cluster to create client certificates. Background information on how to use the CA: https://kubernetes.io/docs/concepts/cluster-administration/certificates/

Basically here is what I did:

Assuming I have a user.json like this:

{
    "CN": "haugom",
    "key": {
        "algo": "rsa",
        "size": 4096
    },
    "names": [{
        "O": "haugom",
        "email": "some@email"
    }]
}

You can then generate a CSR for this. In this example I use cfssl to generate the CSR:

cfssl genkey user.json  | cfssljson -bare client

You can now use kubectl to submit a CSR for your cluster:

cat <<EOF | kubectl create -f -
apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
  name: haugom
spec:
  groups:
  - system:authenticated
  - haugom
  request: $(cat client.csr | base64 | tr -d '\n')
  usages:
  - digital signature
  - key encipherment
  - client auth
EOF

The request field is base64 encoded version of your csr file.

To view your CSR: kubectl get csr

To approve it:

kubectl certificate approve haugom

Decode it:

kubectl get csr haugom -o jsonpath='{.status.certificate}' | base64 -d > client.pem

You can now use the client-key.pem and client.pem to build a kubeconfig.

You can then create RBAC rolebindings on your cluster assigning to either --user=haugom or --group=haugom (assuming you used “O”: “haugom” like I did in this example)

/G

Try DigitalOcean for free

Click below to sign up and get $200 of credit to try our products over 60 days!

Sign up

Get our biweekly newsletter

Sign up for Infrastructure as a Newsletter.

Hollie's Hub for Good

Working on improving health and education, reducing inequality, and spurring economic growth? We'd like to help.

Become a contributor

Get paid to write technical tutorials and select a tech-focused charity to receive a matching donation.

Welcome to the developer cloud

DigitalOcean makes it simple to launch in the cloud and scale up as you grow — whether you're running one virtual machine or ten thousand.

Learn more
DigitalOcean Cloud Control Panel