A private key is the secret half of a public-key credential. Keep it with the identity that uses it to authenticate; do not expose it in a certificate signing request or kubeconfig. section 3.2
Generate and use a private key for a Kubernetes user:
- Generate Carol’s 2,048-bit key with `openssl genrsa -out carol.key 2048`. section 3.2
- Use the key to create a certificate signing request, identifying the user and group through the certificate subject. section 3.2
- Pair the issued client certificate with the private key in a kubeconfig, then verify access through the user’s context. section 3.2
Operational check
After switching to Carol’s context, `kubectl get po` succeeds while deleting a pod returns `Forbidden`; the credential authenticates, and RBAC controls authorization. section 3.2
root@kind-control-plane:/# openssl genrsa -out carol.key 2048 <no output>
Inspect the concise command output for private-key generation. section 3.2
