From 5a9aeb7d269acd4a20a70eb6056071be317a81b2 Mon Sep 17 00:00:00 2001 From: Fernando Karnagi Date: Mon, 20 Apr 2020 09:20:28 +0800 Subject: [PATCH 1/4] Added steps for normal user authentication --- .../access-authn-authz/authentication.md | 2 + .../certificate-signing-requests.md | 94 +++++++++++++++++++ 2 files changed, 96 insertions(+) diff --git a/content/en/docs/reference/access-authn-authz/authentication.md b/content/en/docs/reference/access-authn-authz/authentication.md index 31ae364222..03816a36a8 100644 --- a/content/en/docs/reference/access-authn-authz/authentication.md +++ b/content/en/docs/reference/access-authn-authz/authentication.md @@ -26,6 +26,8 @@ even a file with a list of usernames and passwords. In this regard, _Kubernetes does not have objects which represent normal user accounts._ Normal users cannot be added to a cluster through an API call. +Even though normal user cannot be added via an API call, but any user that presents a valid certificate signed by the cluster’s certificate authority (CA) is considered authenticated. In this configuration, Kubernetes determines the username from the common name field in the ‘subject’ of the cert (e.g., “/CN=bob”). From there, the role based access control (RBAC) sub-system would determine whether the user is authorized to perform a specific operation a resource. You can refer to [creating user certificate request](/docs/reference/access-authn-authz/certificate-signing-requests/#user-csr) for more details about this. + In contrast, service accounts are users managed by the Kubernetes API. They are bound to specific namespaces, and created automatically by the API server or manually through API calls. Service accounts are tied to a set of credentials diff --git a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md index 3e81215dd8..5f4fc41541 100644 --- a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md +++ b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md @@ -226,6 +226,100 @@ rules: - sign ``` +## Normal User + +Few steps are required in order to get normal to be able to authenticate and invoke API. First, this user must have certificate issued by the Kubernetes Cluster, and then present that Certificate into the API call as the Certificate Header, or through the kubectl. + +### Create Private Key + +The following scripts show how to generate PKI private key and CSR. It is important to set CN and O attribute of the CSR. CN is the name of the user and O is the group that this user will belong to. You can refer to [RBAC](/docs/reference/access-authn-authz/rbac/) for standard groups. + +``` +openssl genrsa -out john.key 2048 +openssl req -new -key john.key -out john.csr +``` + +### Create Certificate Request Kubernetes Object + +You then need to create a CertificateSigningRequest and submit it to Kubernetes Cluster via kubectl. Below is script to generate one. + +``` +cat < Date: Tue, 21 Apr 2020 09:00:01 +0800 Subject: [PATCH 2/4] Updated instruction on Create Certificate Request Kubernetes Object --- .../access-authn-authz/certificate-signing-requests.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md index 5f4fc41541..1c35be0708 100644 --- a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md +++ b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md @@ -241,7 +241,7 @@ openssl req -new -key john.key -out john.csr ### Create Certificate Request Kubernetes Object -You then need to create a CertificateSigningRequest and submit it to Kubernetes Cluster via kubectl. Below is script to generate one. +Create a CertificateSigningRequest and submit it to Kubernetes Cluster via kubectl. Below is script to generate one. ``` cat < Date: Tue, 21 Apr 2020 09:12:17 +0800 Subject: [PATCH 3/4] Various updates --- .../access-authn-authz/certificate-signing-requests.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md index 1c35be0708..7f6c181a34 100644 --- a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md +++ b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md @@ -264,7 +264,7 @@ Few points to note: ### Approve Certificate Request -You will need to use kubeadmin to get CSR and approve it. +Use kubeadmin to create a CSR and approve it. Get the list of CSRs ``` @@ -278,10 +278,10 @@ kubectl certificate approve john ### Get the Certificate -Once the CSR is approved, you can collect the Certificate by getting it from the CSR itself. +Retrieve the Certificate from the CSR. ``` -kubectl get csr/john -oyaml +kubectl get csr/john -o yaml ``` The Certifcate value is in Base64 format, under status.certificate. From b2d21616d8c527c7ad3c55d904f96b427a2af654 Mon Sep 17 00:00:00 2001 From: Fernando Karnagi Date: Tue, 21 Apr 2020 09:15:09 +0800 Subject: [PATCH 4/4] updated mistypo --- .../access-authn-authz/certificate-signing-requests.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md index 7f6c181a34..fb62c7692d 100644 --- a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md +++ b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md @@ -228,7 +228,7 @@ rules: ## Normal User -Few steps are required in order to get normal to be able to authenticate and invoke API. First, this user must have certificate issued by the Kubernetes Cluster, and then present that Certificate into the API call as the Certificate Header, or through the kubectl. +Few steps are required in order to get normal user to be able to authenticate and invoke API. First, this user must have certificate issued by the Kubernetes Cluster, and then present that Certificate into the API call as the Certificate Header, or through the kubectl. ### Create Private Key