I want to create new user admin in kubernetes ,i do all the steps for creating and authorizing the certificates but when i want to access to api,i receive anuthorized error. i do these steps to create user-admin:
1/ openssl genrsa -out user.key 2048
2/ openssl req -new -key user.key -out user.csr -subj "/CN=kube-user"
3/
cat <<EOF | kubectl apply -f -
apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
name: user
spec:
request: $(cat user.csr | base64 | tr -d '\n')
usages:
- digital signature
- key encipherment
- server auth
EOF
4/ k certificate approve user
5/ k get csr user -o jsonpath='{.status.certificate}' | base64 --decode > user.crt
6/ kubectl config view -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' --raw | base64 --decode - > ca.crt
7/
curl https://$Kube-Master-Ip:6443/api/v1 \
--key user.key \
--cert user.crt \
--cacert ca.crt
8/ and this is what i've receive:
{
"kind":"Status",
"apiVersion":"v1",
"metadata":{},
"status":"Failure",
"message":"Unauthorized",
"reason":"Unatuhorized",
"code":401
}
document source: https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/
The step 2 command is wrong. The admin user should be part of system:masters group.
openssl req -new -key user.key -out user.csr -subj "/CN=kube-user/O=system:masters"