From ad85bdb054f45b373e178cd93ae87afdb55809f7 Mon Sep 17 00:00:00 2001 From: Mike Patterson Date: Sun, 20 Dec 2020 11:36:20 -0800 Subject: [PATCH 1/5] Include missing cert export step Updating the instructions to include missing step of getting issued cert exported from kubernetes, decoded, and ready for kubeconfig setup. --- .../access-authn-authz/certificate-signing-requests.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md index 6d05d0436a..045b1661aa 100644 --- a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md +++ b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md @@ -252,6 +252,12 @@ kubectl get csr/john -o yaml The certificate value is in Base64-encoded format under `status.certificate`. +Export the issued certificate from the CertificateSigningRequest. + +``` +kubectl get csr john -o jsonpath='{.status.certificate}'| base64 -d > /home/vagrant/work/john.crt +``` + ### Create Role and RoleBinding With the certificate created. it is time to define the Role and RoleBinding for From 6a166cf5112b1b492ef7de6473a8440a1faf943b Mon Sep 17 00:00:00 2001 From: Mike Patterson Date: Wed, 17 Feb 2021 17:34:31 -0800 Subject: [PATCH 2/5] Update content/en/docs/reference/access-authn-authz/certificate-signing-requests.md Co-authored-by: Irvi Aini <7439590+irvifa@users.noreply.github.com> --- .../access-authn-authz/certificate-signing-requests.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md index 045b1661aa..cee4342ddf 100644 --- a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md +++ b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md @@ -255,7 +255,7 @@ The certificate value is in Base64-encoded format under `status.certificate`. Export the issued certificate from the CertificateSigningRequest. ``` -kubectl get csr john -o jsonpath='{.status.certificate}'| base64 -d > /home/vagrant/work/john.crt +kubectl get csr john -o jsonpath='{.status.certificate}'| base64 -d > certificate.crt ``` ### Create Role and RoleBinding @@ -444,4 +444,3 @@ status: * View the source code for the kube-controller-manager built in [approver](https://github.com/kubernetes/kubernetes/blob/32ec6c212ec9415f604ffc1f4c1f29b782968ff1/pkg/controller/certificates/approver/sarapprove.go) * For details of X.509 itself, refer to [RFC 5280](https://tools.ietf.org/html/rfc5280#section-3.1) section 3.1 * For information on the syntax of PKCS#10 certificate signing requests, refer to [RFC 2986](https://tools.ietf.org/html/rfc2986) - From 67a342aae3543374eddbd991b2833bc68b83384e Mon Sep 17 00:00:00 2001 From: Mike Patterson Date: Fri, 19 Feb 2021 13:18:53 -0800 Subject: [PATCH 3/5] Update certificate-signing-requests.md Maintain original docs `/home/vagrant/work/`working directory to be consistent. --- .../access-authn-authz/certificate-signing-requests.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md index cee4342ddf..18a1afa2d0 100644 --- a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md +++ b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md @@ -253,9 +253,10 @@ kubectl get csr/john -o yaml The certificate value is in Base64-encoded format under `status.certificate`. Export the issued certificate from the CertificateSigningRequest. +This example assumes the key and certificate files are located at "/home/vagrant/work/". ``` -kubectl get csr john -o jsonpath='{.status.certificate}'| base64 -d > certificate.crt +kubectl get csr john -o jsonpath='{.status.certificate}'| base64 -d > /home/vagrant/work/john.crt ``` ### Create Role and RoleBinding @@ -278,7 +279,6 @@ kubectl create rolebinding developer-binding-john --role=developer --user=john ### Add to kubeconfig The last step is to add this user into the kubeconfig file. -This example assumes the key and certificate files are located at "/home/vagrant/work/". First, you need to add new credentials: From 1c237dabfa1fa87eedcd539c6fcd5aa8b758ba0d Mon Sep 17 00:00:00 2001 From: Mike Patterson Date: Wed, 17 Mar 2021 15:15:34 -0700 Subject: [PATCH 4/5] Update content/en/docs/reference/access-authn-authz/certificate-signing-requests.md Co-authored-by: Jordan Liggitt --- .../access-authn-authz/certificate-signing-requests.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md index 18a1afa2d0..c6a1d87490 100644 --- a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md +++ b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md @@ -256,7 +256,7 @@ Export the issued certificate from the CertificateSigningRequest. This example assumes the key and certificate files are located at "/home/vagrant/work/". ``` -kubectl get csr john -o jsonpath='{.status.certificate}'| base64 -d > /home/vagrant/work/john.crt +kubectl get csr john -o jsonpath='{.status.certificate}'| base64 -d > john.crt ``` ### Create Role and RoleBinding From f7506a3d9841993a62b88d9998da481b59496491 Mon Sep 17 00:00:00 2001 From: Mike Patterson Date: Wed, 17 Mar 2021 15:38:56 -0700 Subject: [PATCH 5/5] Drop vagrant path and use generic name. --- .../certificate-signing-requests.md | 25 +++++++++---------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md index c6a1d87490..a8d782e3d0 100644 --- a/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md +++ b/content/en/docs/reference/access-authn-authz/certificate-signing-requests.md @@ -196,8 +196,8 @@ O is the group that this user will belong to. You can refer to [RBAC](/docs/reference/access-authn-authz/rbac/) for standard groups. ```shell -openssl genrsa -out john.key 2048 -openssl req -new -key john.key -out john.csr +openssl genrsa -out myuser.key 2048 +openssl req -new -key myuser.key -out myuser.csr ``` ### Create CertificateSigningRequest @@ -209,7 +209,7 @@ cat < john.crt +kubectl get csr myuser -o jsonpath='{.status.certificate}'| base64 -d > myuser.crt ``` ### Create Role and RoleBinding @@ -273,7 +272,7 @@ kubectl create role developer --verb=create --verb=get --verb=list --verb=update This is a sample command to create a RoleBinding for this new user: ```shell -kubectl create rolebinding developer-binding-john --role=developer --user=john +kubectl create rolebinding developer-binding-myuser --role=developer --user=myuser ``` ### Add to kubeconfig @@ -283,20 +282,20 @@ The last step is to add this user into the kubeconfig file. First, you need to add new credentials: ``` -kubectl config set-credentials john --client-key=/home/vagrant/work/john.key --client-certificate=/home/vagrant/work/john.crt --embed-certs=true +kubectl config set-credentials myuser --client-key=myuser.key --client-certificate=myuser.crt --embed-certs=true ``` Then, you need to add the context: ``` -kubectl config set-context john --cluster=kubernetes --user=john +kubectl config set-context myuser --cluster=kubernetes --user=myuser ``` -To test it, change the context to `john`: +To test it, change the context to `myuser`: ``` -kubectl config use-context john +kubectl config use-context myuser ``` ## Approval or rejection {#approval-rejection}