Kubernetes Cookbook - Second Edition

X509 client certs

A common authentication strategy for user accounts is to use client certificates. In the following example, we'll create a user named Linda and generate a client cert for her:

// generate a private key for Linda# openssl genrsa -out linda.key 2048Generating RSA private key, 2048 bit long modulus..............+++..............+++e is 65537 (0x10001)// generate a certificate sign request (.csr) for Linda. Make sure /CN is equal to the username.# openssl req -new -key linda.key -out linda.csr -subj "/CN=linda"

Next, we'll generate a cert for Linda via a private key and sign request files, along with the CA and private key of our cluster:

In minikube, it's under ~/.minikube/. For other self-hosted solutions, normally it's ...