<p>I have deployed a CockroachDB single instance cluster in my Kubernetes cluster on DO following this link <a href="https://www.cockroachlabs.com/docs/stable/orchestrate-a-local-cluster-with-kubernetes.html" rel="nofollow noreferrer">https://www.cockroachlabs.com/docs/stable/orchestrate-a-local-cluster-with-kubernetes.html</a>.  </p>

<p>I followed this link to generate a server.crt file from <a href="https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster</a> using the command:</p>

<pre><code>kubectl get csr my-svc.my-namespace -o jsonpath='{.status.certificate}' \
| base64 --decode &gt; server.crt
</code></pre>

<p>Not sure that gets me a client cert.<br>
The following is my output for the command:</p>

<pre><code>kubectl get csr

NAME                  AGE       REQUESTOR                                              CONDITION
default.client.root   44m       system:serviceaccount:default:my-release-cockroachdb   Approved,Issued
</code></pre>

<p>I need to connect to CockroachDB using my Java client.  How do I generate a client cert and key so I can access CockroachDB from Java? </p>

<p>Thanks</p>

Katlock
<p>There are multiple concerns here:</p>

<ul>
<li>the certificate you are requesting from the k8s PKI will not have any of the fields required</li>
<li>the key format will not work for java clients</li>
</ul>

<p>Let's address them one at a time:</p>

<p><strong>Requesting a client certificate from the kubernetes PKI</strong></p>

<p>A client certificate for user with CockroachDB must the subject's Common Name set to the username. eg: <code>CN=root</code>. This must also be properly configured to allow <code>Client Authentication</code> in the key usage.</p>

<p>In the <a href="https://www.cockroachlabs.com/docs/stable/orchestrate-a-local-cluster-with-kubernetes.html#step-3-use-the-built-in-sql-client" rel="nofollow noreferrer">kubernetes docs</a>, we include an example to bring up a client within the same kubernetes cluster. The <a href="https://github.com/cockroachdb/cockroach/blob/master/cloud/kubernetes/client-secure.yaml" rel="nofollow noreferrer">config</a> for secure clients includes an init container that requests a client certificate and makes it available to the main job.</p>

<p>If your client is running in Kubernetes, I recommend adapting that config for your own client.</p>

<p><strong>Key format for java clients</strong></p>

<p>Java clients expect keys in PKCS#8 format, whereas the certificates output by both your command and the <code>request-cert</code> tool both output PEM encoded keys.</p>

<p>You can convert the key using openssl:</p>

<pre><code>openssl pkcs8 -topk8 -inform PEM -outform DER -in client.myuser.key -out client.myuser.pk8
</code></pre>

<p>You can find more details on the <a href="https://www.cockroachlabs.com/docs/v2.1/build-a-java-app-with-cockroachdb.html#step-4-convert-the-key-file-for-use-with-java" rel="nofollow noreferrer">CockroachDB Build a Java app page</a>.</p>
