<p>So I've gone through the process of generating an RSA key, creating the YAML for a CSR, using kubectl to create a CSR in Minikube, approved the certificate.</p>

<p>However, when I try to download the certificate using <code>kubectl get csr my-csr -o jsonpath='{.status.certificate}'</code> I'm getting an empty result.</p>

<p>When I do a <code>kubectl get csr my-csr -o yaml</code> to get more information, this is what I see:</p>

<pre><code>status:
  conditions:
  - lastUpdateTime: "2020-01-17T20:17:20Z"
    message: This CSR was approved by kubectl certificate approve.
    reason: KubectlApprove
    type: Approved
</code></pre>

<p>I'm expecting a certificate attribute with a base64 encoded string to which I will decode to obtain the certificate for client certificate validation. Can someone please tell me what I'm doing wrong?</p>

<p>For more context, I'm trying to follow the instructions in <a href="https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/" rel="noreferrer">this tutorial</a></p>

<p>I got similar problem. When I check with the following command:</p>

<p>kubectl get svc</p>

<p>It seems that the status of the csr is approved, but not issued. Any idea how to fix it?</p>

<p>[Updated]
I found the problem. It is because the kube-controller-manager missed these options:</p>

<p>--cluster-signing-cert-file and --cluster-signing-key-file</p>
