So let's go through the lab on certificates.
A new member Akshay joined our team.
He requires access to our cluster.
The Certificate Signing Request
is at the root location.
See where we are.
We are in root,
so we have akshay.csr and akshay.key.
Let's look at there in those files.
This is the CSR,
so Certificate Signing Request,
and then here is basically the key.
That's good.
Create a certificate signing,
request object with the name akshay
with the contents of the akshay.csr file.
For this we have to create--
there is no imperative command,
so let's go here and in the CSR
or the Certificate Signing Request page
on Kubernetes.
We have Kubernetes documentation pages.
We have this section here
to create Certificate Signing Requests.
We're going to get this because we want to--
let's skip the first and last lines
because we want to edit this request
and maybe even the expiration dates
because that's not required for now.
I'm going to create a file called akshay.yaml.
I'm going to paste that.
What we need to do
is pass in the csr file here.
Basically, the contents of akshay.csr
needs to go here, but as you can see,
this is in a different format.
This is basically a base64 encoded format.
First, we need to get
the base64 encoded format of this,
and then change this and change the name
and that's maybe get rid of this.
Let's do that.
Let's get cat akshay.csr
then we pass it through base64,
and then we get this.
Now this command base64
by default prints it in this format
with new lines.
That won't work very well here
because it needs to be a single line.
What we're going to do is touch -W 0
and that basically prints it in a single line.
Then we're just going to copy this
and just make sure you copy right til here,
then we go in here,
so request.
Let's paste that, okay.
Then we got to get rid of this line.
That's not required.
Then we have the metadata here
and this is akshay, but also,
so the signer name.
The signer name should be
kubernetes.iokube-apiserver-client.
It's already kube-apiserver-client.
This is good.
Save that and let's create.
It looks like there is an error.
This is illegal base64 data at input 500.
Let's take a look.
If you look here,
I think we missed an equal sign.
Let's just do that again.
You copy that
and request.
That seems to be good,
is going to align that correctly
and let's save this
and let's create that file again.
That's done to get CSR.
The CSR request named actually is created
and you can see it's in pending state.
Let's give this a shot.
That's successful.
What is the condition of the newly created
Certificate Signing Request object?
It's in a pending state select pending.
Now we've got approve the CSR requests,
so let's do a kubectl certificate approve
and then the name.
That's approved and we see that
it's indeed approved.
Now how many CSR requests
are available on the cluster?
So if you look at this,
we have two requests.
Okay, so during a routine check
you realize that there is a new CSR request,
what is the name of this request?
Let's look at that again.
So we see that there is indeed
a new request that's come in
and it's called agent-smith.
Okay, so it's called agent-smith.
Now you're not aware of a request coming in.
What groups is the CSR
requesting access to?
So you see that there's a request and now--
let's see what groups
it's requesting access to.
So we could do a kubectl get CSR agent-smith
and then do view it in yamal format,
that way we get more details
and here you see under the spec section here,
groups and is requesting
for system masters,
system authenticated.
System masters is one
that is requesting access to.
Select system masters.
Now that doesn't look very right,
because we don't want to give system masters,
which is the group which has an access
to a group that has a lot of powers.
We don't want to do that,
so we want to reject that.
Let's do a kubectl certificate
deny agent-smith.
Okay.
Next, let's get rid of it,
delete the new CSR object.
Let's see the status now
and we see that it's denied
and we want to now get rid of it.
We'll do a kubectl delete CSR agent-smith.
Okay, so that should now be gone.
Check it again,
yes and that's indeed gone.
Okay so that's the end of this lab.