<p>I have created a cluster on <code>aws</code> using <code>kops</code>.</p>

<p>However I am unable to find the file used as/by the certificate authority for spawning off client certs.</p>

<p>Does <code>kops</code> create such a thing by default?</p>

<p>If so, what is the recommended process for creating client certs?</p>

<p>The <a href="https://github.com/kubernetes/kops/blob/master/docs/security.md" rel="noreferrer">kops documentation</a> is not very clear about this.</p>

<p>I've done it like <a href="https://gist.github.com/amitkgupta/d5ff7dfc691c0e55162f9196b61964d2#creating-users-in-the-developer-sandbox" rel="noreferrer">this</a> in the past:</p>

<ol>
<li>Download the <code>kops</code>-generated CA certificate and signing key from S3:  

<ul>
<li><code>s3://&lt;BUCKET_NAME&gt;/&lt;CLUSTER_NAME&gt;/pki/private/ca/*.key</code></li>
<li><code>s3://&lt;BUCKET_NAME&gt;/&lt;CLUSTER_NAME&gt;/pki/issued/ca/*.crt</code></li>
</ul></li>
<li>Generate a client key: <code>openssl genrsa -out client-key.pem 2048</code></li>
<li><p>Generate a CSR:</p>

<pre><code>openssl req -new \
  -key client-key.pem \
  -out client-csr.pem \
  -subj "/CN=&lt;CLIENT_CN&gt;/O=dev"`
</code></pre></li>
<li><p>Generate a client certificate:</p>

<pre><code>openssl x509 -req \
  -in client-csr.pem \
  -CA &lt;PATH_TO_DOWNLOADED_CA_CERT&gt; \
  -CAkey &lt;PATH_TO_DOWNLOADED_CA_KEY&gt; \
  -CAcreateserial \
  -out client-crt.pem \
  -days 10000
</code></pre></li>
<li>Base64-encode the client key, client certificate, and CA certificate, and populate those values in a <code>config.yml</code>, e.g. <a href="https://gist.github.com/amitkgupta/d5ff7dfc691c0e55162f9196b61964d2#dev-kube-configyml" rel="noreferrer">this</a></li>
<li>Distribute the populated <code>config.yml</code> to your developers.</li>
</ol>

<p>5 and 6 can obviously be distributed by whatever means you want, don't need to make the <code>config.yml</code> for your developers.</p>
