<p>I've created my certificate cfssl but when I generate my Kubernetes certificates with the file generated by cfssl, my Kubernetes returns the following error:</p>

<pre><code>Error from server (BadRequest): error when creating "certificado.yml": CertificateSigningRequest in version "v1beta1" cannot be handled as a CertificateSigningRequest: v1beta1.CertificateSigningRequest.Spec: v1beta1.CertificateSigningRequestSpec.Usages: []v1beta1.KeyUsage: Request: decode base64: illegal base64 data at input byte 3, error found in #10 byte of ...| -d '\\n'","usages":|..., bigger context ...|,"request":"cat server.csr | base64 | tr -d '\\n'","usages":["digital signature","key encipherment",|...
</code></pre>

<p>I've tried without <code>$()</code> in the request field but it returned the same error.</p>

<p>my certificate.yml:</p>

<pre><code>apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
  name: rasa-service.default
spec:
  groups:
  - system:authenticated
  request: $(cat server.csr | base64 | tr -d '\n')
  usages:
  - digital signature
  - key encipherment
  - server auth
</code></pre>

Daniel Pereira
<p>The problem is the following line:</p>

<pre><code>request: $(cat server.csr | base64 | tr -d '\n')
</code></pre>

<p>This line contains a <a href="http://tldp.org/LDP/abs/html/commandsub.html" rel="nofollow noreferrer">Bash command substitution</a> that shouldn't be there since <code>kubectl</code> cannot interpret bash code.</p>

<p>I suspect instead of executing the <a href="https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/#create-a-certificate-signing-request-object-to-send-to-the-kubernetes-api" rel="nofollow noreferrer">command of the example you followed</a>, you copied the contents into a file.</p>

<p>Delete that file, run the <code>cat</code> command from the example and you will be fine, because the command will execute the substitution and fill the correct value in the <code>request</code> field.</p>

<p>The result should look something like this:</p>

<pre><code>apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
  name: rasa-service.default
spec:
  groups:
  - system:authenticated
  request: authUlRGTQpSVEZNClJURk0KUlRGTQpSVEZNClJURk0KUlRGTQpSVEZNClJURk0KUlRGTQpSVEZNClJURk0=
  usages:
  - digital signature
  - key encipherment
  - server 
</code></pre>
