👤 Users

Kubernetes has no user registry. There is no command like "create user". Instead, the cluster recognizes a person by the certificate they present: the certificate name (CN) becomes the username, and the organization (O) becomes the group.

In this guide you will generate access for a user called maria, who will be able to read pods only.

info

This procedure uses kubectl and openssl. Use Linux, macOS or WSL (on Windows). The Nuvion Panel provides the administrator kubeconfig (Download kubeconfig), but does not create users.

---

🚀 Before you start

• Have administrator access to the cluster configured (see Cluster Access).
• Have the leitor-pods Role (see Roles). If you do not:

kubectl create role leitor-pods --verb=get,list,watch --resource=pods

🚀 1. Create the key and the certificate request

openssl genrsa -out maria.key 2048
openssl req -new -key maria.key -out maria.csr -subj "/CN=maria/O=desenvolvedores"

You will have two files: maria.key (private key, Maria's only) and maria.csr (the certificate request).

🚀 2. Send the request to the cluster

cat <<EOF | kubectl apply -f -
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: maria
spec:
  request: $(base64 < maria.csr | tr -d '\n')
  signerName: kubernetes.io/kube-apiserver-client
  expirationSeconds: 86400
  usages:
    - client auth
EOF

The certificate will be valid for 1 day (86400 seconds). Adjust as needed.

🚀 3. Approve the request

kubectl get csr
kubectl certificate approve maria

The state changes from Pending to Approved,Issued.

🚀 4. Download the certificate

kubectl get csr maria -o jsonpath='{.status.certificate}' | base64 -d > maria.crt

🚀 5. Build Maria's kubeconfig

SERVER=$(kubectl config view --raw --minify -o jsonpath='{.clusters[0].cluster.server}')
kubectl config view --raw --minify -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' | base64 -d > ca.crt

kubectl config set-cluster meu-cluster --server=$SERVER --certificate-authority=ca.crt --embed-certs=true --kubeconfig=maria.kubeconfig
kubectl config set-credentials maria --client-certificate=maria.crt --client-key=maria.key --embed-certs=true --kubeconfig=maria.kubeconfig
kubectl config set-context maria@meu-cluster --cluster=meu-cluster --user=maria --kubeconfig=maria.kubeconfig
kubectl config use-context maria@meu-cluster --kubeconfig=maria.kubeconfig

The maria.kubeconfig file is what you hand to Maria. She uses it as described on the Cluster Access page.

warning

maria.kubeconfig contains the private key. Send it through a secure channel and do not publish it.

🚀 6. Test: without permission

kubectl --kubeconfig=maria.kubeconfig get pods

Expected response: Forbidden. Maria already authenticates (the cluster knows who she is), but has no permission for anything yet.

🚀 7. Grant the permission

kubectl create rolebinding maria-leitora --role=leitor-pods --user=maria

Test again:

kubectl --kubeconfig=maria.kubeconfig get pods
kubectl --kubeconfig=maria.kubeconfig delete pod qualquer-nome

The first command lists the pods. The second is denied (Forbidden), since the Role only allows reading.

To grant the same permission to an entire group, use --group=desenvolvedores instead of --user=maria.

✅ How to know it worked

Step 6 shows Forbidden, and after step 7 Maria can list the pods.

🔒 Best practices

• Use certificates with a short validity and generate a new one when it expires.
• Kubernetes does not revoke certificates. To remove someone's access, delete the RoleBinding, and the certificate no longer has permissions.
• Never hand the administrator kubeconfig to someone who only needs read access.

❗ Common problems

Symptom	Cause	Solution
CSR stays Pending	Needs approval	Run kubectl certificate approve maria
maria.crt empty	CSR was not signed	Check with kubectl get csr maria that the state is Approved,Issued. If not, contact support
Forbidden after step 7	Username differs from the CN	--user must be equal to the certificate's CN
certificate has expired	Validity ended	Generate a new certificate (steps 1 to 5)
already exists when creating the CSR	Name already in use	Delete with kubectl delete csr maria and repeat

🧹 Cleanup

kubectl delete rolebinding maria-leitora
kubectl delete csr maria
rm maria.key maria.csr maria.crt ca.crt maria.kubeconfig

🧠 Questions?

Talk to our SaveinCloud technical support team!