|
| 1 | +### User creation in Kubernetes |
| 2 | + |
| 3 | +Generate new ssl key: |
| 4 | +-------------------- |
| 5 | +```bat |
| 6 | + openssl genrsa -out asimehsan.key 2048 |
| 7 | +``` |
| 8 | + |
| 9 | +Generate new certificate signing request for the issuer authority: |
| 10 | +------------------------------------------------------------------ |
| 11 | +```rs |
| 12 | +#CN is the name of the user |
| 13 | +openssl req -new -key asimehsan.key -out asimehsan.csr -subj "/CN=asimehsan" |
| 14 | + |
| 15 | +OR |
| 16 | + |
| 17 | +#O is the group name. When you will create the rolebinding do the binding based on group name. |
| 18 | +openssl req -new -key asimehsan.key -out asimehsan.csr -subj "/CN=asimehsan/O=cluster:manager" |
| 19 | +``` |
| 20 | + |
| 21 | +Create manifest file csr_template.yaml: |
| 22 | +--------------------------------------- |
| 23 | +```go |
| 24 | +cat <<EOF > csr_template.yaml |
| 25 | +apiVersion: certificates.k8s.io/v1 |
| 26 | +kind: CertificateSigningRequest |
| 27 | +metadata: |
| 28 | +name: asimehsan-csr |
| 29 | +spec: |
| 30 | +request: <Base64_encoded_CSR> |
| 31 | +signerName: kubernetes.io/kube-apiserver-client |
| 32 | +usages: |
| 33 | +- client auth |
| 34 | + EOF |
| 35 | +``` |
| 36 | + |
| 37 | +Save the certificate signing request in base64 encoded in variable CSR_CONTENT: |
| 38 | +------------------------------------------------------------------------------- |
| 39 | +```rs |
| 40 | +CSR_CONTENT=$(cat asimehsan.csr | base64 | tr -d '\n') |
| 41 | +``` |
| 42 | + |
| 43 | +Put the encoded certificate signing request in template manifest: |
| 44 | +----------------------------------------------------------------- |
| 45 | +```rs |
| 46 | +sed "s|<Base64_encoded_CSR>|$CSR_CONTENT|" csr_template.yaml > asimehsan_csr.yaml |
| 47 | +``` |
| 48 | + |
| 49 | +Create the csr resource: |
| 50 | +----------------------- |
| 51 | +```rs |
| 52 | +kubectl create -f asimehsan_csr.yaml |
| 53 | +kubectl get csr |
| 54 | +``` |
| 55 | + |
| 56 | +Do approval as cluster admin user: |
| 57 | +--------------------------------- |
| 58 | +```rs |
| 59 | +kubectl certificate approve asimehsan-csr |
| 60 | +``` |
| 61 | + |
| 62 | +Fetch the issued certificate: |
| 63 | +----------------------------- |
| 64 | +```rs |
| 65 | +kubectl get csr asimehsan-csr -o jsonpath='{.status.certificate}' | base64 --decode > asimehsan.crt |
| 66 | +``` |
| 67 | + |
| 68 | +Take a look on current kubeconfig used: |
| 69 | +------------------------------------- |
| 70 | +```rs |
| 71 | +kubectl config view |
| 72 | +``` |
| 73 | + |
| 74 | +Take a look on the ssl certs directory: |
| 75 | +-------------------------------------- |
| 76 | +```rs |
| 77 | +ls /etc/kubernetes/pki/ |
| 78 | +``` |
| 79 | + |
| 80 | +Generate new kubeconfig file: |
| 81 | +----------------------------- |
| 82 | +```rs |
| 83 | +# Set Cluster Configuration: |
| 84 | +kubectl config set-cluster kubernetes --server=https://<API-Server-IP>:6443 --certificate-authority=/etc/kubernetes/pki/ca.crt --embed-certs=true --kubeconfig=asimehsan.kubeconfig |
| 85 | + |
| 86 | +# Set Credentials for asimehsan: |
| 87 | +kubectl config set-credentials asimehsan --client-certificate=asimehsan.crt --client-key=asimehsan.key --embed-certs=true --kubeconfig=asimehsan.kubeconfig |
| 88 | + |
| 89 | +# Set asimehsan Context: |
| 90 | +kubectl config set-context asimehsan-context --cluster=kubernetes --namespace=default --user=asimehsan --kubeconfig=asimehsan.kubeconfig |
| 91 | + |
| 92 | +# Use asimehsan Context: |
| 93 | +kubectl config use-context asimehsan-context --kubeconfig=asimehsan.kubeconfig |
| 94 | + |
| 95 | + |
| 96 | +# Set KUBECONFIG environment variable pointing to asimehsan.kubeconfig |
| 97 | +export KUBECONFIG=<path>/asimehsan.kubeconfig |
| 98 | + |
| 99 | +# Validate the user rights from admin user |
| 100 | +kubectl auth can-i list pods --as system:serviceaccount:dev:user1 -n dev |
| 101 | +kubectl auth can-i list pods --as asimehsan -n dev |
| 102 | + |
| 103 | +# Validate by user directly |
| 104 | +kubectl auth can-i list pods -n dev |
| 105 | +``` |
| 106 | + |
| 107 | + |
| 108 | +Reference |
| 109 | +--- |
| 110 | + |
| 111 | +-> https://github.com/asimehsan/devops-vu/blob/main/Install%20k8s%20locally/RBAC%20User%20.txt \ |
| 112 | +-> https://youtu.be/w0X4h_etgxA?si=OJDhY_-2ApIo3d3t |
0 commit comments