<p>I'm trying to create a user in a Kubernetes cluster.</p>

<p>I spinned up 2 droplets on DigitalOcean using a Terraform script of mine.</p>

<p>Then I logged in the master node droplet using <code>ssh</code>:</p>

<pre><code>doctl compute ssh droplet1
</code></pre>

<p>Following this, I created a new cluster and a namespace in it:</p>

<pre><code>kubectl create namespace thalasoft
</code></pre>

<p>I created a user role in the <code>role-deployment-manager.yml</code> file:</p>

<pre><code>kind: Role
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  namespace: thalasoft
  name: deployment-manager
rules:
- apiGroups: ["", "extensions", "apps"]
  resources: ["deployments", "replicasets", "pods"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
</code></pre>

<p>and executed the command:</p>

<pre><code>kubectl create -f role-deployment-manager.yml
</code></pre>

<p>I created a role grant in the <code>rolebinding-deployment-manager.yml</code> file:</p>

<pre><code>kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: deployment-manager-binding
  namespace: thalasoft
subjects:
- kind: User
  name: stephane
  apiGroup: ""
roleRef:
  kind: Role
  name: deployment-manager
  apiGroup: ""
</code></pre>

<p>and executed the command:
kubectl create -f rolebinding-deployment-manager.yml</p>

<p>Here is my terminal output:</p>

<pre><code>Last login: Wed Dec 19 10:48:48 2018 from 90.191.151.182
root@droplet1:~# kubectl create namespace thalasoft
namespace/thalasoft created
root@droplet1:~# vi role-deployment-manager.yml
root@droplet1:~# kubectl create -f role-deployment-manager.yml
role.rbac.authorization.k8s.io/deployment-manager created
root@droplet1:~# vi rolebinding-deployment-manager.yml
root@droplet1:~# kubectl create -f rolebinding-deployment-manager.yml
rolebinding.rbac.authorization.k8s.io/deployment-manager-binding created
root@droplet1:~# 
</code></pre>

<p>Now I'd like to first create a user in the cluster, and then configure the client <code>kubectl</code> with this user so as to operate from my laptop and avoid logging via <code>ssh̀</code> to the droplet.</p>

<p>I know I can configure a user in the <code>kubectl</code> client:</p>

<pre><code># Create a context, that is, a user against a namespace of a cluster, in the client configuration
kubectl config set-context digital-ocean-context --cluster=digital-ocean-cluster --namespace=digital-ocean-namespace --user=stephane

# Configure the client with a user credentials
cd;
kubectl config set-credentials stephane --client-certificate=.ssh/id_rsa.pub --client-key=.ssh/id_rsa
</code></pre>

<p>But this is only some client side configuration as I understand.</p>

<p>UPDATE: I could add a user credentials with a certificate signed by the Kubernetes CA, running the following commands on the droplet hosting the Kubernetes master node:</p>

<pre><code># Create a private key
openssl genrsa -out .ssh/thalasoft.key 4096
# Create a certificate signing request
openssl req -new -key .ssh/thalasoft.key -out .ssh/thalasoft.csr -subj "/CN=stephane/O=thalasoft"
# Sign the certificate
export CA_LOCATION=/etc/kubernetes/pki/
openssl x509 -req -in .ssh/thalasoft.csr -CA $CA_LOCATION/ca.crt -CAkey $CA_LOCATION/ca.key -CAcreateserial -out .ssh/thalasoft.crt -days 1024

# Configure a cluster in the client
kubectl config set-cluster digital-ocean-cluster --server=https://${MASTER_IP}:6443 --insecure-skip-tls-verify=true

# Configure a user in the client
# Copy the key and the certificate to the client
scp -o "StrictHostKeyChecking no" root@165.227.171.72:.ssh/thalasoft.* .
# Configure the client with a user credentials
kubectl config set-credentials stephane --client-certificate=.ssh/thalasoft.crt  --client-key=.ssh/thalasoft.key
# Create a context, that is, a user against a namespace of a cluster, in the client configuration
kubectl config set-context digital-ocean-context --cluster=digital-ocean-cluster --namespace=digital-ocean-namespace --user=stephane
</code></pre>

<blockquote>
<p>But this is only some client side configuration as I understand.</p>
<p>What command I should use to create the user ?</p>
</blockquote>
<p>Kubernetes doesn't provide user management. This is handled through x509 certificates that can be signed by your cluster CA.</p>
<p>First, you'll need to create a Key:</p>
<pre><code>openssl genrsa -out my-user.key 4096
</code></pre>
<p>Second, you'll need to create a signing request:</p>
<pre><code>openssl req -new -key my-user.key -out my-user.csr -subj &quot;/CN=my-user/O=my-organisation&quot;
</code></pre>
<p>Third, sign the certificate request:</p>
<pre><code>openssl x509 -req -in my-user.csr -CA CA_LOCATION/ca.crt -CAkey CA_LOCATION/ca.key -CAcreateserial -out my-user.crt -days 500
</code></pre>
<p><code>ca.crt</code> and <code>ca.key</code> is the same cert/key provided by <code>kubeadm</code> or within your master configuration.</p>
<p>You can then give this signed certificate to your user, along with their key, and then can configure access with:</p>
<pre><code>kubectl config set-credentials my-user --client-certificate=my-user.crt  --client-key=my-user.key
kubectl config set-context my-k8s-cluster --cluster=cluster-name --namespace=whatever --user=my-user
</code></pre>
<p>Bitnami provide a great resource that explains all of this:</p>
<p><a href="https://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/#use-case-1-create-user-with-limited-namespace-access" rel="nofollow noreferrer">https://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/#use-case-1-create-user-with-limited-namespace-access</a></p>
