Adding a user to k8s RBAC
In order to add a user to a kubernetes cluster, we will need several things: kubectl, CA.crt and CA.key (found in your head node’s
folder), and openssl.
First, create a private key for the new user. In this example, we will name the file employee.key:
openssl genrsa -out employee.key 2048
Next, we will need to create a certificate sign request – employee.csr – using the private key we just created (employee.key in this example). Make sure to specify your username and group in the
section (CN is for the username and O for the group).
openssl req -new -key employee.key -out employee.csr -subj "/CN=username/O=developer"
Generate the final certificate employee.crt by approving the certificate sign request, employee.csr, you made earlier. In this example, the certificate will be valid for 90 days.
openssl x509 -req -in employee.csr -CA CA.crt -CAkey CA.key -CAcreateserial -out employee.crt -days 90
, and CA.crt
to the new employee and have the employee follow the below steps.
# Set up the cluster
$ kubectl config set-cluster k8s.domain.tld --server https://api.k8s.domain.tld --certificate-authority /path/to/CA.crt --embed-certs=true
# Set up the credentials (a.k.a login information)
$ kubectl config set-credentials <name> --client-certificate=/path/to/cert.crt --client-key=/path/to/cert.key --embed-certs=true
# bind login to server
$ kubectl config set-context k8s.domain.tld --cluster= k8s.domain.tld --user=<name>
# Optional: append `--namespace=<namespace>` to the command to set a default namespace.
: You may move the certificates to a safe location since the commands included
. This saved the certs in base64 format in the kubernetes config.
Sometimes I post to my blog so I remember how to do a particular thing. This is one of those times.