Certificates, kubeconfig and the CSR API

# exam: ssh <control-plane>; sudo -i      lab: docker exec -it cka-control-plane bash
kubeadm certs check-expiration

# Subject, issuer, expiry and SANs of any certificate
openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -subject -issuer -enddate
# subject=CN=kube-apiserver
# issuer=CN=kubernetes
# notAfter=Oct 17 09:51:49 2027 GMT
openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -ext subjectAltName
openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text        # everything

# Renew one certificate, or all of them (on a real cluster; see below before you do)
kubeadm certs renew apiserver
kubeadm certs renew all

apiVersion: v1
kind: Config
clusters:                 # where: API server URL and the CA that signed its certificate
  - name: kind-cka
    cluster:
      server: https://127.0.0.1:52634
      certificate-authority-data: LS0tLS1CRUdJTi...     # base64 PEM, or certificate-authority: /path/ca.crt
users:                    # who: a client certificate, a token or an exec plugin
  - name: jane
    user:
      client-certificate-data: LS0tLS1CRUdJTi...
      client-key-data: LS0tLS1CRUdJTi...
contexts:                 # a named pairing of cluster and user, with an optional default namespace
  - name: jane@kind-cka
    context:
      cluster: kind-cka
      user: jane
      namespace: dev
current-context: jane@kind-cka

kubectl config get-contexts
kubectl config current-context
kubectl config use-context kind-cka
kubectl config set-context --current --namespace=default     # default namespace of the current context
kubectl config view --minify                                 # current context only, secrets redacted
kubectl config view --minify --raw                           # with the embedded data

# Work on a separate file without touching ~/.kube/config
kubectl --kubeconfig=/tmp/cka/jane.kubeconfig config get-contexts
KUBECONFIG=~/.kube/config:/tmp/cka/jane.kubeconfig kubectl config get-contexts    # merged view

mkdir -p /tmp/cka && cd /tmp/cka
openssl genrsa -out jane.key 2048
openssl req -new -key jane.key -subj "/CN=jane/O=developers" -out jane.csr

cat <<EOF | kubectl apply -f -
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: jane
spec:
  request: $(base64 < jane.csr | tr -d '\n')
  signerName: kubernetes.io/kube-apiserver-client
  expirationSeconds: 86400
  usages:
    - client auth
EOF

kubectl get csr jane                  # CONDITION: Pending
kubectl certificate approve jane
kubectl get csr jane                  # CONDITION: Approved,Issued
kubectl get csr jane -o jsonpath='{.status.certificate}' | base64 -d > jane.crt
openssl x509 -in jane.crt -noout -subject -issuer -enddate

# A kubeconfig for jane in its own file. On a control plane node the CA is /etc/kubernetes/pki/ca.crt.
SERVER=$(kubectl config view --minify -o jsonpath='{.clusters[0].cluster.server}')
kubectl config view --minify --raw -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' | base64 -d > ca.crt
kubectl config set-cluster kind-cka --server="$SERVER" --certificate-authority=ca.crt --embed-certs=true --kubeconfig=jane.kubeconfig
kubectl config set-credentials jane --client-certificate=jane.crt --client-key=jane.key --embed-certs=true --kubeconfig=jane.kubeconfig
kubectl config set-context jane@kind-cka --cluster=kind-cka --user=jane --kubeconfig=jane.kubeconfig
kubectl config use-context jane@kind-cka --kubeconfig=jane.kubeconfig

kubectl --kubeconfig=jane.kubeconfig auth whoami
kubectl --kubeconfig=jane.kubeconfig get pods       # Forbidden: authenticated, not yet authorized