Hands-on Lab·Certified Kubernetes Administrator
Creating a User with a CertificateSigningRequest
Kubernetes has no User object. You make one with openssl, a CertificateSigningRequest and an approval - and the first thing the new kubeconfig does is fail with Forbidden, because a certificate authenticates and never authorises.
Cluster Architecture and Configuration Guide 16 of 103 Intermediate
- Kubernetes1.36.4
- Runtimecontainerd 2.2.6
- CNICalico v3.32.1
- TimeAbout 20 min
- Reviewed22 August 2026
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA4001 | 192.168.0.191 | Ubuntu 26.04 LTS | Single Node (control plane, untainted) | 2 Core | 4 GB | 50 GB |
Before you start
- guide 15 - this guide creates the identity that RBAC then grants permissions to.
opensslon the control plane, and read access to/etc/kubernetes/pki/ca.crt.
-
A key and a request, made by the user
-
The cluster does not know that name yet
-
Ask the cluster to sign it
-
Build a kubeconfig, and watch it get refused
-
Now grant it something