<p>I'm trying to configure RBAC to add new user with limited access. I'm following this tutorial: <a href="https://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/#use-case-1-create-user-with-limited-namespace-access" rel="nofollow noreferrer">https://docs.bitnami.com/kubernetes/how-to/configure-rbac-in-your-kubernetes-cluster/#use-case-1-create-user-with-limited-namespace-access</a></p>

<p>It asks me to approve user sign request using Kubernetes CA:</p>

<blockquote>
  <p>Locate your Kubernetes cluster certificate authority (CA). This will be responsible for approving the request and generating the necessary certificate to access the cluster API. Its location is normally /etc/kubernetes/pki/. In the case of Minikube, it would be ~/.minikube/. Check that the files ca.crt and ca.key exist in the location.</p>
</blockquote>

<p>So I need to run the command:</p>

<pre class="lang-sh prettyprint-override"><code>openssl x509 -req -in employee.csr -CA CA_LOCATION/ca.crt -CAkey CA_LOCATION/ca.key -CAcreateserial -out employee.crt -days 500
</code></pre>

<p>But in DigitalOcean I can't access Kubernetes internals (can't touch node droplets).</p>

<p>Is it possible to approve certificate sign request with DigitalOcean?</p>

Kirill
<p>You can use the build in CA in your cluster to create client certificates. </p>

<p>Background information on how to use the CA: <a href="https://kubernetes.io/docs/concepts/cluster-administration/certificates/" rel="nofollow noreferrer">cluster-administration-certificates</a>.</p>

<p>Steps to reproduce:</p>

<ol>
<li>Make sure that you have created JSON user configuration file</li>
</ol>

<p>Example JSON file:</p>

<pre><code>{
    "CN": "example-user",
    "key": {
        "algo": "rsa",
        "size": 4096
    },
    "names": [{
        "O": "example-user",
        "email": "some@email"
    }]
}
</code></pre>

<ol>
<li>Generate CSR for it</li>
<li>Use kubectl command to submit a CSR</li>
<li>the request field is base64 encoded version of your csr file</li>
<li>View your CSR, execute command: <code>kubectl get csr</code></li>
<li>Approve CSR, execute command: <code>kubectl certificate approve example-user</code></li>
<li>Decode certificate,execute command: <code>kubectl get csr example-user -o
jsonpath='{.status.certificate}' | base64 -d &gt; client.pem</code></li>
<li>You can now use the client-key.pem and client.pem to build a
kubeconfig</li>
<li>You can then create RBAC rolebindings on your cluster assigning to
either –user=example-user or –group=example-user (assuming you used
“O”: “example-user” is defined in this example)</li>
</ol>

<p>Here you can find more information: <a href="https://www.digitalocean.com/community/questions/kubernetes-how-do-i-access-the-ca-to-sign-a-new-user-certificate" rel="nofollow noreferrer">certificates</a>.</p>
