Skip to main content
In this article, we review a lab focused on managing SSL/TLS certificates using the Kubernetes Certificates API. In this scenario, a new team member, Akshay, requires access to our cluster. His certificate signing request (CSR) and corresponding private key are stored in the root directory.

​
Verifying Required Files

First, ensure that the required files (akshay.csr and akshay.key) exist in the root directory:

​
Inspecting the Certificate Signing Request (CSR)

Next, inspect the contents of the CSR to verify its integrity:

​
Creating a CertificateSigningRequest Object

To create a Kubernetes CertificateSigningRequest object, you need the CSR in a Base64 encoded format. Since the CSR is in PEM format, encode it using the following command to produce a single-line output (ensuring the proper use of the -w 0 flag with GNU base64):
Once you obtain the encoded string, create a YAML manifest (for example, Akshay.yaml) for the CertificateSigningRequest object. Replace the placeholder in the request: field with the actual one-line Base64 output:
Important: Ensure that the metadata name is adjusted as needed and verify that the Base64 string is accurate. Extra characters or missing padding (an equals sign ”=” at the end) might lead to errors when applying the YAML.
Apply the configuration to create the CSR object:
If the Base64 encoded CSR is not correctly formatted, you might see an error like:
Warning: Check Base64 Formatting: If you encounter errors, recheck that the Base64 output is a single line with proper padding (using the -w 0 flag) and update your YAML manifest accordingly.
After you have fixed any issues and reapplied the YAML, verify that the CSR is created and is in a pending state:

​
Approving the Certificate Signing Request

Approve the CSR for Akshay by running:
After approval, list the CSRs to confirm the updated status:

​
Handling Unwanted Certificate Signing Requests

In this example, a new CSR named “agent-smith” appears. To determine what access is being requested by this CSR, inspect its details in YAML format:
In the output, you’ll notice under the spec section that the groups include:
The inclusion of the group “system:masters” grants elevated privileges, which is not desired. Therefore, this request should be denied. Begin by denying the unwanted CSR:
After denial, remove the rejected CSR from the cluster:
Finally, verify that the unwanted request has been removed by listing the remaining CSRs.

​
Conclusion

This lab demonstrated the process of handling certificate signing requests in Kubernetes. Through this tutorial, you learned how to:
  • Generate and inspect a CSR.
  • Encode the CSR correctly for Kubernetes.
  • Create a CertificateSigningRequest object using a YAML manifest.
  • Approve valid certificate signing requests.
  • Deny and remove CSRs that request inappropriate permissions.
For further details on managing certificate signing requests, please refer to the Kubernetes Certificate Signing Requests documentation.
Certificate Signing Requests Process

Watch Video