kubectl certificate approve
kubectl certificate approve <csr-name> | kubectl certificate deny <csr-name>
Risk: Careful
What it does
Approves a CertificateSigningRequest, so the cluster signs that ID card. It names who, not what they may do.
When to use it
After you check the request: the right name (CN), team (O), signer and usage.
Example
$ kubectl certificate approve ainaSign Aina's ID card. Then give her rights with RBAC.
$ kubectl get csrList the requests and their CONDITION.
$ kubectl get csr aina -o jsonpath='{.status.certificate}' | base64 -d > aina.crtSave the signed card as a file.
Learn it in: Users: CSR, certificates and kubeconfig · Official docs