<p>I saw it on <a href="https://kubernetes.io/docs/admin/authentication/#users-in-kubernetes" rel="nofollow noreferrer">offical doc</a>, but I don't know how to <code>add or introduce</code> a <code>normal user</code> outside kubernetes clusters. And I searched a lot about normal user in kubernetes but nothing useful.</p>

<p>I know it's different from serviceaccount and we cannot add a normal user through Kubernetes API.</p>

<p>Any idea about how to add or introduce a normal user to kubernetes cluster and what's normal user for?</p>

<p>See "<a href="https://medium.com/@etienne_24233/comparing-kubernetes-authentication-methods-6f538d834ca7" rel="nofollow noreferrer">Comparing Kubernetes Authentication Methods</a>" by <a href="https://twitter.com/etiennedi" rel="nofollow noreferrer">Etienne Dilocker</a></p>

<p>A possible solution is the <a href="https://kubernetes.io/docs/admin/authentication/#x509-client-certs" rel="nofollow noreferrer">x509 client certs</a>:</p>

<blockquote>
  <p>Advantages</p>
  
  <p>operating the Kubernetes cluster and issuing user certificates is decoupled
      much more secure than basic authentication</p>
  
  <p>Disadvantages</p>
  
  <p>x509 certificates tend to have a very long lifetime (months or years). So, revoking user access is nearly impossible. If we instead choose to issue short-lived certificates, the user experience drops, because replacing certificates involves some effort.</p>
</blockquote>

<p>But Etienne recommends <a href="https://kubernetes.io/docs/admin/authentication/#openid-connect-tokens" rel="nofollow noreferrer">OpenID</a>:</p>

<blockquote>
  <p>Wouldn’t it be great if we could have short-lived certificates or tokens, that are issued by a third-party, so there is no coupling to the operators of the K8s cluster.<br>
  And at the same time <strong>all of this should be integrated with existing enterprise infrastructure, such as LDAP or Active Directory</strong>.</p>
  
  <p>This is where <a href="http://openid.net/connect/" rel="nofollow noreferrer">OpenID Connect (OIDC)</a> comes in. </p>
  
  <p>For my example, I’ve used <a href="http://www.keycloak.org/" rel="nofollow noreferrer">Keycloak</a> as a token issuer. Keycloak is both a token issuer and an identity provider out-of-the box and quite easy to spin up using Docker. </p>
</blockquote>

<hr>

<p>To use RBAC with that kind of authentication is not straight-forward, but possible.<br>
See "<a href="https://github.com/kubernetes/dashboard/issues/964#issuecomment-240473494" rel="nofollow noreferrer">issue 118; Security, auth and logging in</a>"</p>

<blockquote>
  <p>With 1.3 I have SSO into the dashboard working great with a reverse proxy and OIDC/OAuth2. I wouldn't create an explicit login screen, piggy back off of the RBAC model and the Auth model that is already supported. It would be great to have something that says who the logged in user is though.</p>
</blockquote>

<p>Note that since 1.3, there might be simpler solution.</p>

<p>The same thread includes:</p>

<blockquote>
  <p>I have a prototype image working that will do what I think you're looking for: <a href="https://hub.docker.com/r/mlbiam/openunison-k8s-dashboard/" rel="nofollow noreferrer">https://hub.docker.com/r/mlbiam/openunison-k8s-dashboard/</a></p>
  
  <p>I removed all the requirements for user provisioning and stripped it down to just:</p>
  
  <ul>
  <li>reverse proxy</li>
  <li>integration with openid connect</li>
  <li>display the user's access token</li>
  <li>simple links page</li>
  </ul>
</blockquote>

<p>It <a href="https://github.com/kubernetes/dashboard/issues/964#issuecomment-242497969" rel="nofollow noreferrer">includes the role binding</a>:</p>

<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1alpha1
metadata:
  name: admin-role
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]
  nonResourceURLs: ["*"]
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1alpha1
metadata:
  name: admin-binding
subjects:
- kind: Group
  name: admin
- kind: ServiceAccount
  name: default
  namespace: kube-system
- kind: ServiceAccount
  name: openunison
  namespace: default
roleRef:
  kind: ClusterRole
  name: admin-role
</code></pre>

<p>Again, this was specific to the dashboard RBAC access, and has since been improved with <a href="https://github.com/kubernetes/dashboard/pull/2206" rel="nofollow noreferrer">PR 2206 Add log in mechanism (to dashboard)</a>.</p>

<p>It still can give you some clues in order to link a regular user to kubernetes RBAC.</p>
