<p>Note: I am not running locally on Minikube or something, but GKE - but could be any provider.</p>

<p>I want to be able to create users/contexts in K8s with openssl:</p>

<pre><code>openssl x509 -req -in juan.csr -CA CA_LOCATION/ca.crt -CAKey CA_LOCATION/ca.key -CAcreateserial -out juan.crt -days 500
</code></pre>

<p>How do I get the K8s <code>ca.crt</code> and <code>ca.key</code>? - I found this for <code>ca.crt</code>, but is this the way and still missing the ca.key?</p>

<pre><code>kubectl get secret -o jsonpath="{.items[?(@.type==\"kubernetes.io/service-account-token\")].data['ca\.crt']}" | base64 --decode
</code></pre>

<p>And, other way than logging into master node <code>/etc/kubernetes/pki/.</code></p>

<p>I would suggest viewing the following <a href="https://kubernetes.io/docs/concepts/cluster-administration/certificates/#openssl" rel="nofollow noreferrer">documentation</a> on how to generate a ca.key and ca.crt for your kubernetes cluster. Please keep in mind this is not an official google document, however this may help you achieve what you are looking for.</p>

<p>Here are the commands found in the document.</p>

<p>Generate ca.key: <code>openssl genrsa -out ca.key 2048</code></p>

<p>Generate ca.cert: <code>openssl req -x509 -new -nodes -key ca.key -subj "/CN=${MASTER_IP}" -days 10000 -out ca.crt</code></p>

<p>EDIT </p>

<p>I found 2 unsupported documents <a href="https://deliciousbrains.com/ssl-certificate-authority-for-local-https-development/" rel="nofollow noreferrer">[1]</a> <a href="https://jamielinux.com/docs/openssl-certificate-authority/sign-server-and-client-certificates.html#create-a-key" rel="nofollow noreferrer">[2]</a> on generating a certificate and key with openssl, it should be applicable with kubernetes. </p>
