A certificate is a signed credential used to establish identity in Kubernetes communication. The certificate authority (CA) signs certificates that clients use to verify a server; a server may also require a client certificate. The Kubernetes API uses certificates to authenticate requests from clients such as kubectl and cluster components. section 1.7 section 2.2.1
Client and server certificates serve different roles, and one component can have both. For example, the kubelet uses a client certificate when connecting to the API and has a separate server certificate. The API server likewise has a server certificate and client certificates for connections to etcd and the kubelet. For cluster inspection, check kubelet credentials under /var/lib/kubelet/pki and control-plane certificates under /etc/kubernetes/pki; routine cluster bootstrap creates these credentials for you. section 2.2.1 section 2.4
root@kind-control-plane:/# cat /etc/kubernetes/kubelet.conf
apiVersion: v1
clusters:
- cluster:
certificate-authority-data:
LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1ekNDQWMrZ0F3SUJBZ00FURS0tLS
0tCg==
server: https://kind-control-plane:6443
name: kind
contexts:
- context:
cluster: kind
user: system:node:kind-control-plane
name: system:node:kind-control-plane@kind
current-context: system:node:kind-control-plane@kind
kind: Config
preferences: {}
users:
- name: system:node:kind-control-plane
user:
client-certificate: /var/lib/kubelet/pki/kubelet-client-current.pem
client-key: /var/lib/kubelet/pki/kubelet-client-current.pem
The kubelet kubeconfig shows the API server address, CA data, and the client certificate and key paths used by the kubelet. section 2.2.1
To issue a client certificate for a user and make it available to kubectl:
- Generate a private key and signing request with OpenSSL. Put the username in the request’s common name; an organization can carry group information. For example: openssl req -new -key carol.key -subj "/CN=carol/O=developers" -out carol.csr. section 3.2 section 3.4
- Submit a Kubernetes CertificateSigningRequest for client authentication using signerName kubernetes.io/kube-apiserver-client and usage client auth. Check kubectl get csr, then approve it with kubectl certificate approve carol. Verify that its condition changes from Pending to Approved,Issued. section 3.2
- Extract the issued certificate with kubectl get csr carol -o jsonpath='{.status.certificate}' | base64 -d > carol.crt. Add the key and certificate with kubectl config set-credentials carol --client-key=carol.key --client-certificate=carol.crt --embed-certs, then create and select a context for that user. section 3.2
Verify identity separately from permission
After selecting the new user’s context, try kubectl get po and kubectl delete po nginx. In the worked scenario, the user can list the pod but deletion returns Forbidden. The certificate identifies the user; RBAC roles and bindings determine which operations that user may perform. Test permissions rather than assuming that a valid certificate grants access to every resource. section 3.2 section 3.4
