limited user in Kubernetes cluster

Опубликовано: 04 Май 2026
на канале: Ahmed Salah El-Din

✅ create a key and certificate request

openssl genrsa -out ahmed.key 2048
openssl req -new -key ahmed.key -out ahmed.csr -subj "/CN=ahmed/O=eng"\n

✅ create certificate request object

cat ⍃⍃EOF | kubectl apply -f -
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
name: ahmed
spec:
request: $(cat ahmed.csr | base64 | tr -d "\n")
signerName: kubernetes.io/kube-apiserver-client
usages:
client auth
EOF

✅ approve the request

kubectl get csr
kubectl certificate approve ahmed

✅ extract the user certificate

kubectl get csr ahmed -o jsonpath='{.status.certificate}'| base64 -d ⩺ ahmed.crt

✅ role and rolebinding

kubectl create role developer --verb=create --verb=create,delete,update,get --resource=pods

kubectl create rolebinding developer --role=developer --user=ahmed

✅ add user credentials

kubectl config set-credentials ahmed --client-key=ahmed.key --client-certificate=ahmed.crt --embed-certs=true

✅ user context

kubectl config set-context developer --cluster=kubernetes --user=ahmed

✅ assert user actions

kubectl config use-context developer

kubectl auth can-i create svc
kubectl auth can-i create pod
kubectl auth can-i create deploy
kubectl auth can-i create role --as ahmed
kubectl get pod --as ahmed