<p>I was trying to automate the process of signing Kubernetes certificates for new users.<br />
The official documentation (<a href="https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/#normal-user" rel="nofollow noreferrer">here</a>) suggests using Kubectl. In particular they suggest using the command :</p>
<p><code>kubectl certificate approve csr_name</code></p>
<p>and obtain a base64 encoded certificate via :</p>
<p><code>kubectl get csr/csr_name -o yaml </code></p>
<p>and looking at the <code>status.certificate</code> field. Since I have access to the cluster certificates ( at /etc/kubernetes/pki) and since I wanted to further automate the process I was wondering which certificate and key are used by Kubernetes in the signing process. I've tried with apiserver, ca and kubeadmin (.crt and .key) and openssl as follows :</p>
<p><code>openssl x509 -req my.csr -days 365 -CA /etc/kubernetes/*.crt -CAkey /etc/kubernetes/*.key -CAcreateserial -out my.crt</code></p>
<p>where <code>*.crt</code> and <code>*.key</code> are the various files mentioned above. But the results are always different from that of the kubectl command. Any idea what I am missing?</p>
<p>Thanks in advance!</p>

MFranc
<p>Very partial answer for this moment</p>
<p><strong>1.</strong> <strong>CA for etcd, kube-apiserver, kube-controller-manager, kube-scheduler, kubelet, and kube-proxy</strong></p>
<blockquote>
<p>Since I have access to the cluster certificates ( at
/etc/kubernetes/pki) and since I wanted to further automate the
process I was wondering which certificate and key are used by
Kubernetes in the signing process.</p>
</blockquote>
<p>There is a great <a href="https://github.com/kelseyhightower/kubernetes-the-hard-way" rel="nofollow noreferrer">Kubernetes The Hard Way</a> tutotial that give you great opportunity to check,test and try by your own how to manually create kubernetes cluster using manually create all the certificates for core resources.</p>
<p><a href="https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/04-certificate-authority.md" rel="nofollow noreferrer">Provisioning a CA and Generating TLS Certificates</a></p>
<blockquote>
<p>you will provision a PKI Infrastructure using CloudFlare's PKI
toolkit, cfssl, then use it to bootstrap a Certificate Authority, and
generate TLS certificates for the following components: etcd,
kube-apiserver, kube-controller-manager, kube-scheduler, kubelet, and
kube-proxy.</p>
</blockquote>
<p><a href="https://github.com/kelseyhightower/kubernetes-the-hard-way/blob/master/docs/05-kubernetes-configuration-files.md#generating-kubernetes-configuration-files-for-authentication" rel="nofollow noreferrer">Generating Kubernetes Configuration Files for Authentication</a></p>
<blockquote>
<p>you will generate Kubernetes configuration files, also known as
kubeconfigs, which enable Kubernetes clients to locate and
authenticate to the Kubernetes API Servers.</p>
</blockquote>
<p><strong>2.</strong> <strong>New user creation</strong>
you can use <a href="https://www.digitalocean.com/community/questions/kubernetes-how-do-i-access-the-ca-to-sign-a-new-user-certificate" rel="nofollow noreferrer">Kubernetes: How do I access the CA to sign a new user certificate?</a> as a reference. Copy pasting for history in case original post would be removed</p>
<blockquote>
<p>you can use the build in CA in your cluster to create client
certificates. Background information on how to use the CA:
<a href="https://kubernetes.io/docs/concepts/cluster-administration/certificates/" rel="nofollow noreferrer">https://kubernetes.io/docs/concepts/cluster-administration/certificates/</a></p>
</blockquote>
<p>Assuming you have a user.json</p>
<pre><code>{
    &quot;CN&quot;: &quot;mfrank&quot;,
    &quot;key&quot;: {
        &quot;algo&quot;: &quot;rsa&quot;,
        &quot;size&quot;: 4096
    },
    &quot;names&quot;: [{
        &quot;O&quot;: &quot;mfrank&quot;,
        &quot;email&quot;: &quot;some@email&quot;
    }]
}
</code></pre>
<blockquote>
<p>You can then generate a CSR for this. In this example I use cfssl to
generate the CSR:</p>
</blockquote>
<pre><code>cfssl genkey user.json  | cfssljson -bare client
</code></pre>
<blockquote>
<p>You can now use kubectl to submit a CSR for your cluster:</p>
</blockquote>
<pre><code>cat &lt;&lt;EOF | kubectl create -f -
apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
  name: mfrank
spec:
  groups:
  - system:authenticated
  - mfrank
  request: $(cat client.csr | base64 | tr -d '\n')
  usages:
  - digital signature
  - key encipherment
  - client auth
EOF
</code></pre>
<blockquote>
<p>The request field is base64 encoded version of your csr file.</p>
<p>To view your CSR: kubectl get csr</p>
<p>To approve it:</p>
</blockquote>
<pre><code>kubectl certificate approve mfrank
</code></pre>
<blockquote>
<p>Decode it:</p>
</blockquote>
<pre><code>kubectl get csr mfrank -o jsonpath='{.status.certificate}' | base64 -d &gt; client.pem
</code></pre>
<blockquote>
<p>You can now use the client-key.pem and client.pem to build a
kubeconfig.</p>
<p>You can then create RBAC rolebindings on your cluster assigning to
either –user=mfrank or –group=mfrank (assuming you used “O”: “mfrank”)</p>
</blockquote>
