How to Create Certificate Signing Request in Kubernetes

Background

Kubernetes allows you to utilize a public key infrastructure (PKI) for client authentication to your cluster.

You use a CertificateSigningRequest as part of this process, and either you or some other principal must approve the request.

Below is our setup

Step 1: Create a Private Key

openssl genrsa -out perry.key 3072

This will generate a private key named perry.key

Step 2: Create a Certificate Signing Request

openssl req -new -key perry.key -out perry.csr -subj "/CN=perry"

This will generate a certificate signing request named perry.csr

Step 3: Encode the CSR Document to base 64 Format

cat myuser.csr | base64 | tr -d "\n"

Step 4: Create the Certificate Signing Request in Kubernetes Cluster

Login to your Kubernetes Cluster then create a Certificate Signing Request Object. I am assuming you had already login by this time.

Open and Editor

vi certificatesigningrequest.yaml

Enter this in Editor

apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: perry
spec:<Your base 64 encoded key here>
  request: 
  signerName: kubernetes.io/kube-apiserver-client
  expirationSeconds: 86400  # one day
  usages:
  - client auth

Create the CSR Object using kubectl

kubectl apply -f certificatesigningrequest.yaml

Step 5: Review and Approve the Certificate Signing Request

List the CSR Object

	kubectl get csr

View the Details of Certificate

	kubectl get csr perry

Approve the Certificate Signing Request

kubectl certificate approve perry

Export the certificate from the CertificateSigningRequest object

Decode the key back to base 64

kubectl get csr perry -o jsonpath='{.status.certificate}'| base64 -d > perry-signed.crt

Step 6: Add the user to a Context

To test the CSR, import the approved certificate to a kubectl client. This will allow us to test successfull connection to the cluster.

Run this in one of your kubectl client

kubectl config set-credentials perry --client-key=perry.key --client-certificate=perry-signed.crt --embed-certs=true

Associate the User to a new Context

kubectl config set-context perry --cluster=kubernetes --user=perry

Step 7: Create a Role and RoleBinding

Do the following command in your cluster by administrator.

Role Creation

kubectl create role developer --verb=create --verb=get --verb=list --verb=update --verb=delete --resource=pods

Bind the Role

kubectl create rolebinding developer-binding-perry --role=developer --user=perry

Step 7: Test your new Context from a kubectl client

Run this command in the client kubectl

This will change the context and use the user created earlier using the certificate.

kubectl config use-context perry

Test a kubectl command by getting pods

kubectl get pods

As you can see, we were able to connect to the kubernetes cluster from a kubectl in a client jumphost.