title: How do I get the K8s `ca.crt` and `ca.key` running K8s on a service provider(GKE)
body: <p>Note: I am not running locally on Minikube or something, but GKE - but could be any provider.</p>
  
  <p>I want to be able to create users/contexts in K8s with openssl:</p>
  
  <pre><code>openssl x509 -req -in juan.csr -CA CA_LOCATION/ca.crt -CAKey CA_LOCATION/ca.key -CAcreateserial -out juan.crt -days 500
  </code></pre>
  
  <p>How do I get the K8s <code>ca.crt</code> and <code>ca.key</code>? - I found this for <code>ca.crt</code>, but is this the way and still missing the ca.key?</p>
  
  <pre><code>kubectl get secret -o jsonpath="{.items[?(@.type==\"kubernetes.io/service-account-token\")].data['ca\.crt']}" | base64 --decode
  </code></pre>
  
  <p>And, other way than logging into master node <code>/etc/kubernetes/pki/.</code></p>