Page cover
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Create the User Certificate

Generate a Private Key

openssl genrsa -out .key 2048

Create a Certificate Signing Request

CN becomes the username. O becomes a group and is optional

openssl req -new \-key <USERNAME>.key \-out <USERNAME>.csr \-subj "/CN=<USERNAME>/O=<GROUP>"

TIP If you do not need a group, omit /0=<GROUP> from the subject string.

Base64-Encode the CSR

CSR_B64=$(openssl base64 -A -in <USERNAME>.csr)

Submit the CSR to Kubernetes

kubectl delete certificatesigningrequest <USERNAME>-csr >-ignore-not
found=true
cat ><EOF | kubectl apply -f 
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: <USERNAME>-csr
spec:
  request: ${CSR_B64}
  signerName: kubernetes.io/kube-apiserver-client
  expirationSeconds: 31536000
  usages:
    - client auth
EOF

Note : expirationSeconds is a requested lifetime. The signer ultimately controls the issued certificate lifetime. For certificates.k8s.io/v1, the minimum valid value is 600

Approve the CSR

Retrieve the Signed Certificate

Verify the Certificate

Expected subject fields:

  • CN=<USERNAME>

  • 0=<GROUP> if you included a group

Clean Up the CSR Object

Generated files:

File
Purpose

<USERNAME>.key

Private key. Keep it secret.

<USERNAME>.csr

PKCS#10 certificate signing request

<USERNAME>.crt

Signed client certificate

Last updated