Hands-on Lab·Certified Kubernetes Administrator
Creating a User with a CertificateSigningRequest
Kubernetes has no User object. You make one with openssl, a CertificateSigningRequest and an approval - and the first thing the new kubeconfig does is fail with Forbidden, because a certificate authenticates and never authorises.
Cluster Architecture and Configuration Guide 16 of 103 Intermediate
- Kubernetes1.36.4
- Cluster1 node
- Runtimecontainerd 2.2.6
- CNICalico v3.32.1
- TimeAbout 20 min
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA4001 | 192.168.0.191 | Ubuntu 26.04 LTS | Single Node (control plane, untainted) | 2 Core | 4 GB | 50 GB |
This guide includes
Use this when a person needs their own credentials on a cluster. This matters because Kubernetes has no User object - a user is a signed certificate plus RBAC, and the cluster does not know the name at all until something is bound to it.
- generating a private key and a certificate request as the user rather than as the cluster
- confirming the cluster does not recognise that name yet with
auth can-i --as= - submitting the request as a CertificateSigningRequest object and approving it
- building a kubeconfig from the signed certificate and watching it still be refused
- granting a Role and RoleBinding to that user name, and watching the same command succeed
Before you start
- guide 15 - this guide creates the identity that RBAC then grants permissions to.
opensslon the control plane, and read access to/etc/kubernetes/pki/ca.crt.
-
A key and a request, made by the user
-
The cluster does not know that name yet
-
Ask the cluster to sign it
-
Build a kubeconfig, and watch it get refused
-
Now grant it something