Kubernetes: How do I access the CA to sign a new user certificate?

Hi

Yes you can use the build in CA in your cluster to create client certificates. Background information on how to use the CA: https://kubernetes.io/docs/concepts/cluster-administration/certificates/

Basically here is what I did:

Assuming I have a user.json like this:

{
    "CN": "haugom",
    "key": {
        "algo": "rsa",
        "size": 4096
    },
    "names": [{
        "O": "haugom",
        "email": "some@email"
    }]
}

You can then generate a CSR for this. In this example I use cfssl to generate the CSR:

cfssl genkey user.json  | cfssljson -bare client

You can now use kubectl to submit a CSR for your cluster:

cat <<EOF | kubectl create -f -
apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
  name: haugom
spec:
  groups:
  - system:authenticated
  - haugom
  request: $(cat client.csr | base64 | tr -d '\n')
  usages:
  - digital signature
  - key encipherment
  - client auth
EOF

The request field is base64 encoded version of your csr file.

To view your CSR: kubectl get csr

To approve it:

kubectl certificate approve haugom

Decode it:

kubectl get csr haugom -o jsonpath='{.status.certificate}' | base64 -d > client.pem

You can now use the client-key.pem and client.pem to build a kubeconfig.

You can then create RBAC rolebindings on your cluster assigning to either --user=haugom or --group=haugom (assuming you used “O”: “haugom” like I did in this example)

/G