Hands-on Lab·Kubernetes and Cloud Native Security Associate
kubeconfig Files and Client Certificates
Client security is a Domain 2 competency and a kubeconfig is the client. This guide opens the ones kubeadm wrote, reads the certificate inside the admin file, and finds that it is not the identity most people assume.
Cluster Component Security Guide 16 of 42 Intermediate
- Kubernetesapiserver v1.36.4, kubelet v1.36.3
- Runtimecontainerd 2.2.6
- CNICilium 1.18.1
- Built withkubeadm v1.36.3
- TimeAbout 16 min
kubeadm v1.36. The admin.conf / super-admin.conf split arrived in kubeadm 1.29 - before that, admin.conf carried system:masters. If your knowledge predates it, this page is the correction.
- Host kernel7.0.0-29
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA5001 | 192.168.0.41 | Ubuntu 26.04 LTS | Control Plane Node (tainted NoSchedule) | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE01 | 192.168.0.42 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE02 | 192.168.0.43 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE03 | 192.168.0.44 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
This guide includes
Use this when you need to know what a kubeconfig actually grants. This matters because the client is the credential - a kubeconfig carries an embedded certificate, and the subject inside it is the entire identity.
- listing the kubeconfig files a kubeadm cluster writes, including one people rarely see
- extracting the certificate out of
admin.confand reading its subject - reading the group in that subject, which is where the privilege actually comes from
Before you start
- guide 13 - the other certificate identity on this node.
-
Five files, and one you may not have seen
-
Who admin.conf actually is