<p>I want to access an external k8s cluster which is running in private cloud. Do you have any idea how can I get these parameters? What should I do in order to generate them?</p>
<p>${CLIENT_CERTIFICATE_DATA}
fake-cert-file
fake-key-file</p>
<pre><code>apiVersion: v1
kind: Config
clusters:
- cluster:
    certificate-authority-data: ${CLUSTER_CA}
    server: ${CLUSTER_ENDPOINT}
  name: ${CLUSTER_NAME}
users:
- name: ${USER}
  user:
    client-certificate-data: $**{CLIENT_CERTIFICATE_DATA}**
contexts:
- context:
    cluster: ${CLUSTER_NAME}
  user:
    client-certificate: **fake-cert-file**
    client-key: **fake-key-file**
  name: ${USER}-${CLUSTER_NAME}
current-context: ${USER}-${CLUSTER_NAME}
</code></pre>

DobreMihaela
<p>The steps to allow an access for a &quot;bob&quot; user are the followings:</p>
<h2>Create a new CSR via openssl</h2>
<p><code>openssl req -new -newkey rsa:4096 -nodes -keyout bob-k8s.key -out bob-k8s.csr -subj &quot;/CN=bob/O=devops&quot;</code></p>
<h2>Create Kubernetes CertificateSigningRequest object</h2>
<p>use
<code>kubectl create –edit -f k8s-csr.yaml</code></p>
<p>and you should input the following</p>
<pre class="lang-sh prettyprint-override"><code>apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
  name: bob-k8s-access
spec:
  groups:
  - system:authenticated
  request: # replace with output from shell command: cat bob-k8s.csr | base64 | tr -d '\n'
  usages:
  - client auth
</code></pre>
<h3>Verify your CSR object</h3>
<p><code>kubectl get csr</code></p>
<h2>Approve your certificate</h2>
<p><code>kubectl certificate approve bob-k8s-access</code></p>
<h3>Verify your Bob's certificate</h3>
<p><code>kubectl get csr bob-k8s-access -o jsonpath='{.status.certificate}' | base64 --decode &gt; bob-k8s-access.crt</code></p>
<h2>Retrieve the cluster CA certificate</h2>
<p><code>kubectl config view -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' --raw | base64 --decode - &gt; k8s-ca.crt</code></p>
<h2>Setup Bob's kubeconfig file</h2>
<p><code>$ kubectl config set-cluster $(kubectl config view -o jsonpath='{.clusters[0].name}') --server=$(kubectl config view -o jsonpath='{.clusters[0].cluster.server}') --certificate-authority=k8s-ca.crt --kubeconfig=bob-k8s-config --embed-certs</code></p>
<p>after this command a <code>bob-k8s-config</code> file should be created with Bob's .kube configuration</p>
<h2>Setup Bob's credential accesses</h2>
<p><code>kubectl config set-credentials bob --client-certificate=bob-k8s-access.crt --client-key=bob-k8s.key --embed-certs --kubeconfig=bob-k8s-config</code></p>
<h2>Create a context in your config</h2>
<p><code>kubectl config set-context bob --cluster=$(kubectl config view -o jsonpath='{.clusters[0].name}') --namespace=&lt;ns-for-bob&gt; --user=bob --kubeconfig=bob-k8s-config</code></p>
<h2>Assign roles within the namespace</h2>
<p><code>kubectl create rolebinding bob-admin --namespace=&lt;ns-for-bob&gt; --clusterrole=admin --user=bob</code></p>
<p>For more information about permissions, please, look at the <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">Kubernetes configuration page</a></p>
<hr />
<p>I've written this instructions starting from <a href="https://www.openlogic.com/blog/granting-user-access-your-kubernetes-cluster" rel="nofollow noreferrer">this guide</a> that is more exhaustive!</p>
