Lab 26 - Users, certificates and kubeconfig

Lab 26 - Users, certificates and kubeconfig

Goal: create user jane (group dev-team) with a certificate signed by the cluster, and log in as her. Chapter: Authentication and authorization

# 1 - who am I now?
kubectl auth whoami

kubernetes-admin, group kubeadm:cluster-admins - the certificate in your kubeconfig.

Jane asks for a certificate

# 2 - private key and CSR: CN = user name, O = group
mkdir -p ~/jane && cd ~/jane
openssl genrsa -out jane.key 2048
openssl req -new -key jane.key -out jane.csr -subj "/CN=jane/O=dev-team"

# 3 - send it to the cluster
cat > csr.yaml <<YAML
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: jane
spec:
  request: $(base64 -w0 jane.csr)
  signerName: kubernetes.io/kube-apiserver-client
  expirationSeconds: 86400
  usages: ["client auth"]
YAML
kubectl apply -f csr.yaml
kubectl get csr jane                  # Pending

The admin approves

# 4 -
kubectl certificate approve jane
kubectl get csr jane                  # Approved,Issued
kubectl get csr jane -o jsonpath='{.status.certificate}' | base64 -d > jane.crt
openssl x509 -in jane.crt -noout -subject -issuer -enddate

Issuer = the cluster CA, valid 24 h - because we asked for expirationSeconds: 86400.

A kubeconfig for Jane

# 5 - same cluster, new user, new context
kubectl config set-credentials jane --client-certificate=jane.crt \
  --client-key=jane.key --embed-certs=true
kubectl config set-context jane --cluster=kubernetes --user=jane --namespace=dev
kubectl config get-contexts

# 6 - log in as Jane
kubectl create ns dev
kubectl --context jane auth whoami
kubectl --context jane get pods

whoami works - she is authenticated. get pods is Forbidden - nobody has authorized her yet. That is Lab 27.

Discovery

Infodiscover

Task A. Without Jane’s credentials, check as admin whether she may list Pods in dev.

kubectl auth can-i list pods -n dev --as jane --as-group dev-team

Task B. Jane’s laptop is stolen. How do you revoke her certificate?

You cannot - Kubernetes has no certificate revocation. You can only remove her RBAC bindings (the certificate then authenticates but is authorized for nothing) and wait for expiry. Hence: short-lived certificates, OIDC for people.

Keep

Keep the jane context and namespace dev - Lab 27 uses them.