Kubernetes - User Creation with RBAC

This guide shows how to create a user authenticated with a client certificate, bind one of Kubernetes' built-in RBAC roles, generate a kubeconfig, and revoke access later.

This is a how-to guide, not a general reference for every Kubernetes authentication method

Kubernetes does not maintain a built-in user database. This workflow assumes your cluster accepts X.509 client certificates and that you will issue the certificate through the Kubernetes CSR API

Scope

• Users authenticated with client certificates

• Built-in RBAC roles: cluster-admin, admin, edit, view

• Access revocation for bindings created for those users

For applications and automation, prefer ServiceAccount identities instead of long-lived client certificates

Prerequisites

• kubectl configured with cluster-admin access to the target cluster

• openssl installed

• base64 available (Linux or macOS)

• Your current kubeconfig points at the target cluster

Placeholders

Replace these placeholders before running any command :

Placeholder	Meaning	Example
<USERNAME>	Kubernetes username from the certificate CN	alice
<GROUP>	Optional group from the certificate 0	developers
<NAMESPACE>	Target namespace	production
<NAMESPACE1>	First target namespace	development
<NAMESPACE2>	Second target namespace	staging