Yet, we often hear things like:

“Create a user and give access to the cluster.”

So what’s really happening under the hood?

In this guide, we’ll walk through how to create a Kubernetes user using client certificates, assign permissions using RBAC, and configure access using kubeconfig.

By the end, you’ll understand:

• How Kubernetes handles identity

• How authentication and authorisation actually work

• And how to securely give access to a cluster

🔍 The Reality: Kubernetes Has No Users

Kubernetes does not store users internally.

Instead, it works in two steps:

1. Authentication (Who are you?)

Kubernetes verifies identity using:

Certificates Tokens External providers (OIDC)

2. Authorisation (What can you do?)

Handled using RBAC (Role-Based Access Control).

👉 A “user” in Kubernetes is simply:

An identity backed by a trusted certificate

🔐 Step 1: Create a Private Key and CSR

First, we generate a private key and a Certificate Signing Request (CSR):

openssl genrsa -out ekam.key 2048

openssl req -new -key ekam.key -out ekam.csr -subj "/CN=ekam/O=group1"

🧠 What’s happening here?

• CN=ekam → Username

• O=group1 → Group

We are basically saying:

“This identity should be recognised as ekam”

🏛️ Step 2: Ask Kubernetes CA to Sign the Certificate

We now send the CSR to Kubernetes:

cat ekam.csr | base64 | tr -d '\n'

After this you will get a output like this :

1. You need to copy the output .

2. You need to use vi command to create a csr.yaml file and need to copy the following code provided.

3. The output that you copied from (1) pointer should be pasted in 6th line in the request option by leaving a space after colon.

apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: ekam
spec:
  request: here paste the output from pointer (1)
  signerName: kubernetes.io/kube-apiserver-client
  usages:
  - client auth

Apply and approve:

kubectl apply -f csr.yaml
kubectl certificate approve ekam

Retrieve the signed certificate:

kubectl get csr ekam -o jsonpath='{.status.certificate}' \
| base64 --decode > ekam.crt

🧠 What just happened?

• Kubernetes verified and signed our request using its Certificate Authority (CA)

• Now, our identity is trusted by the cluster

🛂 Step 3: Assign Permissions Using RBAC

Right now, the user exists—but has no permissions.

Let’s fix that.

1. use this mentioned command, to create roles and users

cat << EOF | kubectl apply -f -

1. then use the mentioned code for creating roles

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  namespace: default
  name: pod-reader
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["get", "watch", "list"]
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: read-pods
  namespace: default
subjects:
- kind: User
  name: ekam
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: pod-reader
  apiGroup: rbac.authorization.k8s.io

🧠 What’s happening here?

• The Role (pod-reader) defines what actions are allowed:

  • Read pods (get, watch, list) in the default namespace

• The RoleBinding connects that Role to our user:

  • It says: “Give these permissions to user ekam”

⚙️ Step 4: Configure kubeconfig

Now we connect this identity to our cluster:

kubectl config set-credentials ekam --client-certificate=ekam.crt --client-key=ekam.key
kubectl config get-contexts
kubectl config set-context ekam-context --cluster=kubernetes --namespace=default --user=ekam
kubectl config use-context ekam-context

Now I have created a user named ekam who can only access get , watch and list pods.

I’m Ekamveer Walia, I keep a strong interest in cloud computing and Kubernetes. I enjoy breaking down complex systems into simple, practical concepts and building things that actually work.

Currently, I’m focused on sharpening my skills in cloud and distributed systems with the goal of working in global tech environments. If you found this useful, feel free to connect or follow along—more hands-on content coming soon.

🔗 Twitter

🧑🏻‍💻 GitHub

🔎 LinkedIn