<p>Note: I am not running locally on Minikube or something, but GKE - but could be any provider.</p>

<p>I want to be able to create users/contexts in K8s with openssl:</p>

<pre><code>openssl x509 -req -in juan.csr -CA CA_LOCATION/ca.crt -CAKey CA_LOCATION/ca.key -CAcreateserial -out juan.crt -days 500
</code></pre>

<p>How do I get the K8s <code>ca.crt</code> and <code>ca.key</code>? - I found this for <code>ca.crt</code>, but is this the way and still missing the ca.key?</p>

<pre><code>kubectl get secret -o jsonpath="{.items[?(@.type==\"kubernetes.io/service-account-token\")].data['ca\.crt']}" | base64 --decode
</code></pre>

<p>And, other way than logging into master node <code>/etc/kubernetes/pki/.</code></p>

Chris G.
<p>You don't.  Google do not expose the keys as per the <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/cluster-trust#root_of_trust" rel="nofollow noreferrer">documentation</a>.</p>
<p>Specifically and I quote:</p>
<blockquote>
<p>An internal Google service manages root keys for this CA, which are non-exportable. This service accepts certificate signing requests, including those from the kubelets in each GKE cluster. Even if the API server in a cluster were compromised, the CA would not be compromised, so no other clusters would be affected.</p>
</blockquote>
<p>Using Kubernetes v1.19 and higher you can sign your CSR using the Kubernetes API itself as referenced <a href="https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/" rel="nofollow noreferrer">here</a>.</p>
<p>Encode your CSR <code>$ ENCODED=$(cat mia.csr | base64 | tr -d &quot;\n&quot;)</code>.</p>
<p>Then post it to k8s:</p>
<pre><code>$ cat &lt;&lt;EOF | kubectl apply -f -
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: mia
spec:
  request: $ENCODED
  signerName: kubernetes.io/kube-apiserver-client
  #expirationSeconds: 86400  # Only supported on &gt;=1.22
  usages:
  - client auth
EOF
</code></pre>
<p>And then approve the CSR:</p>
<pre><code>$ kubectl certificate approve mia
certificatesigningrequest.certificates.k8s.io/mia approved
</code></pre>
<p>Then download the signed certificate:</p>
<pre><code>kubectl get csr mia -o jsonpath='{.status.certificate}'| base64 -d &gt; mia.crt
</code></pre>
<p>I wrote an example of the end to end flow <a href="https://medium.com/@mattgillard/creating-a-kubernetes-rbac-user-in-google-kubernetes-engine-gke-fa930217a052" rel="nofollow noreferrer">here</a>.</p>
