<p>I need to create users to assign them permissions with RBAC, I create them as follows:</p>

<pre><code>echo -n "lucia" | base64
bHVjaWE=
echo -n "pass" | base64
cGFzcw==

apiVersion: v1
kind: Secret
metadata:
  name: lucia-secret
type: Opaque
data:
  username: bHVjaWE=
  password: cGFzcw==
</code></pre>

<p>Or create with:</p>

<pre><code>kubectl create secret generic lucia-secret --from-literal=username='lucia',password='pass'
</code></pre>

<p>I don't know how to continue</p>

<pre><code>USER_NICK=lucia

kubectl config set-credentials $USER_NICK \
    --username=lucia \
    --password=pass

kubectl get secret lucia-secret -o json | jq -r '.data["ca.crt"]' | base64 -d &gt; ca.crt

endpoint=`kubectl config view -o jsonpath="{.clusters[?(@.name == \"$name\")].cluster.server}"`

kubectl config set-cluster cluster-for-lucia \
  --embed-certs=true \
  --server=$endpoint \
  --certificate-authority=./ca.crt

kubectl config set-context context-lucia \
  --cluster=cluster-for-lucia \
  --user=$USER_NICK \
  --namespace=default
</code></pre>

<p>ca.crt is null</p>

<p>Thank you for your help!</p>

<p>As kubernetes <a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/" rel="noreferrer">docs</a> and Articles uses certificate to create or authenticate users for kubectl client. However there is one easy way to do it by using ServiceAccount. One can use ServiceAccount as a group to provide RBAC control authentication and it is very easy and descriptive. Here are the steps.
All the steps i am executing is in <code>default</code> namespace. I am going to create a pod readonly user which can get,list,watch any pod in all namespaces.</p>

<ul>
<li><p>Create a ServiceAccount, say 'readonlyuser'.</p>

<p><code>kubectl create serviceaccount readonlyuser</code></p></li>
<li><p>Create cluster role, say 'readonlyuser'.</p>

<p><code>kubectl create clusterrole readonlyuser --verb=get --verb=list --verb=watch --resource=pods</code></p></li>
<li><p>Create cluster role binding, say 'readonlyuser'.</p>

<p><code>kubectl create clusterrolebinding readonlyuser --serviceaccount=default:readonlyuser --clusterrole=readonlyuser</code></p></li>
<li><p>Now get the token from secret of ServiceAccount we have created before. we will use this token to authenticate user.</p>

<p><code>TOKEN=$(kubectl describe secrets "$(kubectl describe serviceaccount readonlyuser | grep -i Tokens | awk '{print $2}')" | grep token: | awk '{print $2}')</code></p></li>
<li><p>Now set the credentials for the user in kube config file. I am using 'vikash' as username.</p>

<p><code>kubectl config set-credentials vikash --token=$TOKEN</code></p></li>
<li><p>Now Create a Context say podreader. I am using my clustername 'kubernetes' here.</p>

<p><code>kubectl config set-context podreader --cluster=kubernetes --user=vikash</code></p></li>
<li><p>Finally use the context .</p>

<p><code>kubectl config use-context podreader</code></p></li>
</ul>

<p>And that's it. Now one can execute <code>kubectl get pods --all-namespaces</code>. One can also check the access by executing as given:</p>

<pre><code>~ : $ kubectl auth can-i get pods --all-namespaces
yes
~ : $ kubectl auth can-i create pods
no
~ : $ kubectl auth can-i delete pods
no
</code></pre>
