A Kubernetes user is an identity principal represented by credentials, commonly a client certificate, when authenticating to the Kubernetes API. Kubernetes does not store users in a built-in database; RBAC assigns permissions to the authenticated username or its groups. section 3.2 section 3.4
Create and use a certificate-backed user through this operational sequence:
- Generate a private key and certificate signing request, placing the username in the certificate common name and groups in organization fields; the example uses carol and developers. section 3.2
- Bind permissions with roles, cluster roles, role bindings, or cluster role bindings, then verify access by switching contexts and attempting permitted or forbidden operations. section 3.4
Carol, a pod-reader user
A certificate identifies Carol as user carol and group developers. After the developers group receives a pod-reader role binding, Carol can list pods but receives Forbidden when attempting to delete one.
Figure 3.11 Creating a kubeconfig for a new user and generating a certificate using the certificate signing request
Trace the relationship between certificate generation, kubeconfig construction, and API access for a new user. section 3.2
