18 Dec 2019 / 2 min read

New administrator user on Kubernetes

Hello guys, in this tutorial I show and explain commands used to generate new TLS certificates for a new "admin" on your Kubernetes cluster.

> Archived article from 2019, from the old nutellino.it: commands and versions may be out of date.

# archive# kubernetes# rbac# security# tls# openssl

.archive-gate.is-locked .archive-gated{filter:none;pointer-events:auto;user-select:auto;max-height:none;-webkit-mask-image:none;mask-image:none}.archive-backdrop,.archive-dialog{display:none}

Yay! Another fellow admin!

Hello guys,
in this tutorial I show and explain commands used to generate new TLS certificates for a new "admin" on your Kubernetes cluster.

As requester

Fist of all, generate a private key of the user:

bash

openssl genrsa -out sam.key 4096

Create a file named sam.cnf

text

[ req ]
default_bits = 2048
prompt = no
default_md = sha256
distinguished_name = dn

[ dn ]
CN = sam
O = administrators

[ v3_ext ]
authorityKeyIdentifier=keyid,issuer:always
basicConstraints=CA:FALSE
keyUsage=keyEncipherment,dataEncipherment
extendedKeyUsage=serverAuth,clientAuth

This cnf files set user "sam" (CN).

Create csr file with

bash

openssl req -config ./sam.cnf -new -key sam.key -nodes -out sam.csr

Now give your sam.csr to a system administrator.

As an existing administrator

As a system administrator, you should create a CertificateSigningRequest using csr object

Create yaml

bash

cat <<EOF | kubectl apply -f -
apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
  name: sam-request
spec:
  groups:
  - system:authenticated
  request: $(cat sam.csr | base64 | tr -d '\n')
  usages:
  - client auth
EOF

Then, approve request using:

bash

kubectl certificate approve sam-request

Now you can extract crt with this command:

bash

kubectl get csr sam-request -o jsonpath='{.status.certificate}' | base64 --decode > sam.crt

Now, attach clusterrole cluster-admin to sam (as a reminder, sam is defined on CN) user

bash

kubectl create clusterrolebinding sam-admin --clusterrole=cluster-admin --user=sam

Again, as requester

Let administrators send you ca.crt and sam.crt to generate your kubeconfig

Set cluster info

bash

export CURRENT_PATH=$(pwd)
kubectl config --kubeconfig=config-demo set-cluster development --server=https://yourendpoint:6443 --certificate-authority=fullpath/ca.crt

Set user info

bash

kubectl config --kubeconfig=config-demo set-credentials sam --client-certificate=fullpath/sam.crt --client-key=fullpath/sam.key

Create new context "development"

bash

kubectl config --kubeconfig=config-demo set-context development --cluster=development --user=sam

Set current context

bash

kubectl config --kubeconfig=config-demo use-context development

Now everything should work using your new kubeconfig file!

bash

kubectl get nodes --kubeconfig=/Volumes/Data/Nutellino/terraform/cka/sam-crt/config-demo

Cheers! :)

lock on banner by Technology vector created by rawpixel.com - www.freepik.com