> For the complete documentation index, see [llms.txt](https://docs.cloudeka.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.cloudeka.ai/reference/kubernetes-user-creation-with-rbac.md).

# Kubernetes - User Creation with RBAC

This guide shows how to create a user authenticated with a client certificate, bind one of\
Kubernetes' built-in RBAC roles, generate a kubeconfig, and revoke access later.

{% hint style="info" %}
This is a how-to guide, not a general reference for every Kubernetes authentication\
method
{% endhint %}

{% hint style="warning" %}
Kubernetes does not maintain a built-in user database. This workflow assumes your\
cluster accepts X.509 client certificates and that you will issue the certificate through the\
Kubernetes CSR API
{% endhint %}

## Scope

* Users authenticated with client certificates
* Built-in RBAC roles: `cluster-admin, admin, edit, view`
* Access revocation for bindings created for those users

{% hint style="info" %}
For applications and automation, prefer `ServiceAccount` identities instead of long-lived client certificates
{% endhint %}

## Prerequisites

* `kubectl` configured with cluster-admin access to the target cluster
* `openssl` installed
* `base64` available (Linux or macOS)
* Your current kubeconfig points at the target cluster

## Placeholders

Replace these placeholders before running any command :

| Placeholder    | Meaning                                       | Example       |
| -------------- | --------------------------------------------- | ------------- |
| `<USERNAME>`   | Kubernetes username from the certificate `CN` | `alice`       |
| `<GROUP>`      | Optional group from the certificate `0`       | `developers`  |
| `<NAMESPACE>`  | Target namespace                              | `production`  |
| `<NAMESPACE1>` | First target namespace                        | `development` |
| `<NAMESPACE2>` | Second target namespace                       | `staging`     |