<p>Note: To generate a Kubeconfig file for other users, you need to have admin permissions in the cluster to create service accounts and roles. And these admin permissions is given to the default/admin/initial kube-config file that created while setting up the cluster.</p>
<p>When a cluster created on minikube or k3s or k3d. We get a kube config file directly &amp; by using this Kube config file we can create many other (by making request to the api-server, to create service account token) kube-configs for different users.</p>
<p>But how is this default/admin/initial kube config file is created without requiring access to the api-server?</p>

sharad regoti
<p>After a little bit of research, I found the following information</p>
<p>Different authentication mechanism exists for authenticating requests coming to the api-server
Regardless of Initial or nth kube-config, the creation process of kube-config is same.
See the below process</p>
<p>The Kube-Config creation process is simple</p>
<ul>
<li>Pre-requisites
<ul>
<li>Need to have certificates of the cluster CA</li>
<li>If certificates is used for auth, Need to have a public-private cert of the user for whom the kube-config is being created</li>
<li>If token is used for auth, Need to have a service account token of the user for whom the kube-config is being created</li>
<li>IP address of the API server (usually a load balancer IP)</li>
</ul>
</li>
<li>Process</li>
</ul>
<pre><code>KUBERNETES_PUBLIC_ADDRESS=43.8.5.8

kubectl config set-cluster kubernetes-the-hard-way \
  --certificate-authority=ca.pem \
  --embed-certs=true \
  --server=https://${KUBERNETES_PUBLIC_ADDRESS}:443

kubectl config set-credentials admin \
  --client-certificate=admin.pem \
  --client-key=admin-key.pem

kubectl config set-context kubernetes-the-hard-way \
  --cluster=kubernetes-the-hard-way \
  --user=admin

kubectl config use-context kubernetes-the-hard-way
</code></pre>
<p>After provisioning cluster myself, I have understood the following</p>
<p>The initial/admin kube-config uses certificate mechanism for authentication that's why it doesn't not require API calls to the api-server</p>
<p>Check this page to see <a href="https://github.com/prabhatsharma/kubernetes-the-hard-way-aws/blob/master/docs/04-certificate-authority.md" rel="nofollow noreferrer">how certs are generated for these components</a></p>
<p>After the server is up &amp; running we <a href="https://github.com/prabhatsharma/kubernetes-the-hard-way-aws/blob/master/docs/10-configuring-kubectl.md" rel="nofollow noreferrer">create the admin config as mentioned here</a> using the certificates created in the above process.</p>
<p>After this any kube-config created can use either the certificate method or service account method</p>
<p>I highly recommend provisioning a Kubernetes cluster yourself to get more understanding &amp; this guide can help you with that <a href="https://github.com/prabhatsharma/kubernetes-the-hard-way-aws" rel="nofollow noreferrer">AWS</a> <a href="https://github.com/kelseyhightower/kubernetes-the-hard-way" rel="nofollow noreferrer">GCP</a></p>
