Kubernetes CertificateSigningRequest (CSR) API & Manage User Certificates

By -

Hello everyone!

Welcome back to the Kubernetes Security Series. In this article, we'll explore the Kubernetes CertificateSigningRequest (CSR) API, an important security feature that helps Kubernetes administrators securely manage user authentication using certificates.

If you're preparing for the CKA (Certified Kubernetes Administrator) exam, working in a DevOps/DevSecOps role, or managing Kubernetes clusters in production, understanding the CSR workflow is essential.

What You'll Learn

By the end of this blog tutorial, you will be able to:

  • Understand the role of Certificate Authorities (CA) in Kubernetes
  • Generate private and public key pairs
  • Create a Certificate Signing Request (CSR)
  • Submit a CSR to Kubernetes
  • Review, approve, or deny certificate requests
  • Retrieve and decode signed certificates
  • Understand how Kubernetes Controller Manager handles certificate operation
User Certificate Approval process


What is the Kubernetes Certificate API?

Kubernetes uses certificates to authenticate users, components, and services within the cluster.

The CertificateSigningRequest (CSR) API allows Kubernetes administrators to securely request, review, approve, and issue certificates without manually interacting with the Certificate Authority (CA).

What Does a Certificate Authority (CA) Do?

A Certificate Authority (CA) is responsible for:

  • Verifying certificate requests
  • Signing certificates
  • Establishing trust between users and systems
  • Managing certificate lifecycles

In Kubernetes, the cluster CA is used to sign certificates for users and components that need authenticated access to the cluster.

Real-World Scenario

Imagine a new Kubernetes administrator named Maheshwari (Mahi) joins your  DevSecOps team.

To access the Kubernetes cluster securely, Mahi needs a certificate signed by the cluster's Certificate Authority.

The Kubernetes CSR workflow consists of four main steps:

  1. Create a CertificateSigningRequest object
  2. Review the request
  3. Approve or deny the request
  4. Share the signed certificate with the user

Let's walk through the process step by step.

Step 1: Generate a Private Key

First, generate a private key using the RSA algorithm.

openssl genrsa -out mahi.key 2048 

This command creates a 2048-bit RSA private key named:

mahi.key

Step 2: Create a Certificate Signing Request (CSR)

Next, create a CSR using the private key and specify the subject name.: 
openssl req -new -key mahi.key -subj "/CN=mahi" -out mahi.csr

This generates:

mahi.csr
The CSR contains the information that will be submitted to Kubernetes for certificate approval.

Step 3: Convert the CSR to Base64

Kubernetes expects the CSR content to be Base64 encoded.

Run:
cat mahi.csr | base64 |tr -d "\n" 

Copy the generated output.

You will use this encoded value in the Kubernetes CSR manifest.

Step 4: Create the Kubernetes CSR Manifest

Create a file named:: mahi-csr.yaml 
  ---
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: mahi 
spec:
  groups:
  - system:authenticated
  request: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS0tLS0KTUlJQ1ZEQ0NBVHdDQVFBd0R6RU5NQXNHQTFVRUF3d0ViV0ZvYVRDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRApnZ0VQQURDQ0FRb0NnZ0VCQUs0eDJyd3QzU2F0ZDhxSThEUzJzVDlTcngydHMrQm5Ic202d2lCdkt0Vk5IeXdKCis3Q2VHR09JdlpWN3hOQ08vRkRpT3FXY05HMzhseFR6R2pwWkdqUDNoR2RZdHU1WFNnRjlBbkFGTVZENHBnOVIKOVQzVFBjbU1Rem9ZVllMUE44c2Y5Z3pWdGIrRHV5YTRPd0dVYUNuOUdvaW0yYUV0MTYxOWpmUzRSeEJPVXpjagpFaS9DWlAvY1VUd2dLZWNpTHRKWHhvSGYxRDVuVUhVUFFPQ1JWbGtJSDNkRmZYVWZHSjg3bmpNMzJyRXBqY3gxCkNVZWgzRktLNVA3ZC8rdFB2TUFuNEQ5MzgvLzlvZjBuLzZDa0pSMnZNUStIbkgyK000azArcGVpaWNwSUxQRS8KZVZuNk41UXpUSk5sWldHdmVTMU9ZYzdBczhGa2Q2OXZKanJHcHZjQ0F3RUFBYUFBTUEwR0NTcUdTSWIzRFFFQgpDd1VBQTRJQkFRQXV0ZlpQTTlVODlqaFR5ZzhXSkdsRThlOStuWXZ2MjBJQ08wTVV3bVB6dWNvWU1NMlNiK0x5CmhiS0lod3pUVW9QTk91RGk5aEEwaElVS0tmdmxiNENTOHI1UmJneWdheDNMUHpENXlZS1ZZTGR5NmNYRW9EWmoKbUx5d1VpTHY4UnNKdjI3TUF4bEZoZnBrZXFodTZPVTJBaGlWR
signerName: kubernetes.io/kube-apiserver-client
  usages:
  - client auth

Replace:

<BASE64_ENCODED_CSR_CONTENT>
with the output generated in the previous step.

Step 5: Create the CertificateSigningRequest

Submit the CSR to Kubernetes.

kubectl create -f mahi-csr.yaml

Expected output:

certificatesigningrequest.certificates.k8s.io/mahi created

Step 6: Check CSR Status

View the current CSR status:

kubectl get csr

Example output:

NAME   AGE   SIGNERNAME                              REQUESTOR   CONDITION
mahi   10s   kubernetes.io/kube-apiserver-client     admin       Pending

The status may show:

  • Pending
  • Approved
  • Issued
  • Denied

Step 7: Review and Approve the CSR

Kubernetes administrators should review certificate requests before approving them.

Approve the CSR:

kubectl certificate approve mahi

Expected output:

certificatesigningrequest.certificates.k8s.io/mahi approved

Once approved, Kubernetes signs the certificate automatically.

Step 8: Deny a Suspicious CSR

If a request appears suspicious or unauthorized, it can be denied.

kubectl certificate deny agent-xyz

Always validate:

  • User identity
  • Requested permissions
  • Business justification

before approving certificate requests.

Step 9: Delete an Unwanted CSR

If a CSR is invalid or no longer required:

kubectl delete csr agent-xyz 


Verify deletion:
kubectl get csr # To confirm it is deleted

Step 10: Retrieve the Signed Certificate

Once approved, view the CSR details.

kubectl get csr mahi -o yaml  

You will notice a field similar to:

status:
  certificate: LS0tLS1CRUdJTi...
The certificate is Base64 encoded.

Step 11: Decode the Certificate

Copy the certificate value and decode it.

echo "PASTE CERTIFICATE VALUE HERE" | base64 --decode

The output should resemble:

-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

This is the signed client certificate that can be shared with the user.

How Kubernetes Signs Certificates

Certificate approval and signing operations are handled by the Kubernetes Controller Manager.

The Controller Manager includes controllers such as:

  • CSR Approving Controller
  • CSR Signing Controller

These controllers automatically process approved certificate requests.

To inspect the Controller Manager configuration:

cat /etc/kubernetes/manifests/kube-controller-manager.yaml

Within the configuration, you'll find references to:

  • Cluster CA certificate
  • Cluster CA private key

These are used to sign approved certificate requests.

Reader Challenge

Try the following hands-on exercises in your lab environment:

Beginner Challenge

  1. Create a new user called devops-user.
  2. Generate a private key and CSR.
  3. Submit the CSR to Kubernetes.
  4. Approve the request.
  5. Retrieve the signed certificate.

Intermediate Challenge

  1. Create certificates for three different users.
  2. Approve one request.
  3. Deny another request.
  4. Delete the third request.
  5. Observe how CSR statuses change.

Advanced Challenge

  1. Configure RBAC permissions for a newly created certificate user.
  2. Verify access using:
kubectl auth can-i --list
  1. Test certificate-based authentication against the cluster.

Share your results and observations in the comments!

Official Document reference: 

Comments

Post a Comment

Popular Articles

Ansible URI Module Tutorial: Real-World Application Health Checks, REST API Validation and DevOps Automation

By -
Image
Hello DevSecOps and Automation Engineers! Welcome back to the DevOps Hunter blog. One of the most common requirements in enterprise automation is validating whether an application is actually available after a deployment, patching activity, server reboot, or service restart. Simply starting a service does not guarantee that the application is ready to serve users. This is where the Ansible uri module becomes one of the most powerful tools in a DevOps engineer's toolkit. In this hands-on tutorial, we will explore the Ansible URI module, understand its key parameters, and work through several real-world examples that are commonly used in production automation workflows. Production Health Check workflow using URI module What You'll Learn By the end of this article, you will be able to: Understand the purpose of the Ansible URI module Perform HTTP and HTTPS application health checks Validate application response codes Test REST API endpoints Handle multiple acceptable HTTP status...
Read more

DevOps Weapons

By -
Image
To achieve faster application delivery and stable environments, the right tools must be used in DevOps environments. There is no single tool that fits all your needs such as server provisioning, configuration management, automated builds, code deployments, and monitoring. Many factors determine the use of a particular tool in your infrastructure.   In this article, we will look into core tools which can be used in a typical Devops environment. Version Control Tools: Git - An awesome tool to version your source code and collaborate. Terraform  - A tool used in building, changing, and versioning the infrastructure across platforms. Build Orchestration/Continuous Integration Tools: Jenkins - It is an open-source, lightweight CI tool written in Java, with high extensibility and a fast release cycle. Buildbot  - An open-source framework for automating software build, test and release process. CruiseControl  - A CI server written in  # Ruby ...
Read more

Ansible Jinja2 Templates: A Complete Guide with Examples

By -
Image
Here I'm starting this post with famous ARISTOTLE quote. "We are what we repeatedly do. Excellence, then is not an act, but a Habit" Welcome back Ansible Automations and who are habituated as Ansible automation specialists this post for them to give boosted walk through, In this post, I would like to share my experiments with Jinja2 templates usage on the Ansible playbook. Of-course Jinja is from Japan it is world famous for templatization capabilities badvanced Ansible templating techniquesy integrating with multiple languages such as Python, Ruby, Salt talk etc. In this post we will be cover the following topics: What is Jinja2 template do in Ansible? Template with filters Template with Lists and sets Template module in Ansible Template with Flow Control Template using Looping Template inheritance** What is Jinja2 template do in Ansible? Jinja2 is another Python library created for Flask web framework, that comes part of Ansible installation. It is special ability as i...
Read more