World map

 

BM

World K9: Cluster Admin

Users: CSR, certificates and kubeconfig

You will learn: how a new person gets a signed ID card, and why they still need RBAC rights.

Checked with Kubernetes 1.37 on 1 Nov 2026

The problem

Aina joins the kitchen team. Where do you add her as a Kubernetes user?

Watch

Tap each point on the timeline.

Tap each step of a new staff badge. A CSR (certificate signing request): A form asking the office to sign a new ID card. It carries a name (CN) and a team (O). is the form that asks the office to sign one.

Try it

Build Aina’s request. CN is her name. O is her team.

Tap the pieces in the right order.

…

Try it

This CSR asks for a server’s card. Aina signs in as a client. Fix the usage.

Change the YAML. The box below shows how a computer reads it.

aina-csr.yaml12 lines

How a computer reads it

  • apiVersioncertificates.k8s.io/v1text
  • kindCertificateSigningRequesttext
  • metadatamap · 1 keys
    • nameainatext
  • specmap · 4 keys
    • requestLS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0Ktext
    • signerNamekubernetes.io/kube-apiserver-clienttext
    • expirationSeconds86400number
    • usageslist · 1 items
      • item 1server authtext

Predict

You run kubectl certificate approve aina. She signs in with her new card. Can she list the trays?

Try it

The Role cook (read trays) exists. Bind it to user aina. Then ask as her.

You are here: cluster kind-dev namespace default
dev-control-planeOpenManager

No trays here.

dev-workerOpen
  • shop·cnpkq
  • shop·p48s7
dev-worker2Open
  • shop·n6vrq
Time: +0s (sped up)

Check

Who are you, or what may you do? Sort them.

Drag a card into a box. Or tap the card, then tap the box.

      Check

      Aina’s card is signed. Put her kubeconfig steps in order.

      First step at the top. Put these in order. Use the arrows, or drag.

      • kubectl --context aina auth whoami
      • kubectl config set-context aina --cluster=kind-dev --user=aina
      • kubectl config set-credentials aina --client-key=aina.key --client-certificate=aina.crt --embed-certs=true
      • kubectl get csr aina -o jsonpath='{.status.certificate}' | base64 -d > aina.crt

      You did it!

      You can now sign a new user’s card and grant their rights.

      Go deeper (optional)

      expirationSeconds: 86400 asks for a one-day card. The minimum is 10 minutes. Our practice terminal has no CSR objects. Do this part on kind. Never share or commit the .key file.

      Real mission

      1. openssl genrsa -out aina.key 3072
      2. openssl req -new -key aina.key -out aina.csr -subj "/CN=aina/O=kitchen"
      3. cat aina.csr | base64 | tr -d "\n"
      4. kubectl apply -f aina-csr.yaml && kubectl certificate approve aina
      5. kubectl get csr aina

      0 of 5 steps done · Your ticks are saved.