Task Information: Generate a client key/CSR for audit2, approve it, extract the signed cert, and build a kubeconfig using that cert.
AnswerA
ExplanationGenerate private key and CSR
openssl genrsa -out audit2.key 2048
openssl req -new -key audit2.key -out audit2.csr -subj '/CN=audit2/O=auditors'
CN becomes username; O can map to groups in some setups.
Base64 encode CSR for the API object
CSR=$(base64 -w0 audit2.csr)
Kubernetes CSR object expects base64-encoded request data.
Create the CSR object
cat <<EOF | oc apply -f -
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
name: audit2-csr
spec:
request: ${CSR}
signerName: kubernetes.io/kube-apiserver-client
usages:
- client auth
EOF
Approve the CSR
oc adm certificate approve audit2-csr
Approval triggers certificate issuance.
Extract the signed certificate
oc get csr audit2-csr -o jsonpath='{.status.certificate}' | base64 -d > audit2.crt
Produces the client certificate file.
Build kubeconfig using cert/key
oc config set-credentials audit2 \
--client-certificate=audit2.crt --client-key=audit2.key \
--embed-certs=true --kubeconfig=audit2.kubeconfig
oc config set-cluster lab \
--server='$(oc whoami --show-server)' \
--insecure-skip-tls-verify=true \
--kubeconfig=audit2.kubeconfig
oc config set-context audit2 \
--cluster=lab --user=audit2 --namespace=default \
--kubeconfig=audit2.kubeconfig
Creates a kubeconfig that authenticates using client certificates.
Test
oc --kubeconfig=audit2.kubeconfig get ns
==========