K8s Cluster Admin Access

Give yourself full k8s Cluster Access with full Admin rights from your laptop.

Types of access to k8s

There are three main categories of accesses in a k8s cluster:

• Admin access (full access for administrators)
• User access (limited access for other cluster users, usually limited to name space(s))
• Service account access (access allowing applications Jenkins to perform actions on the cluster)

Admin access

Prerequisites:

1. In your master-node create a directory client_certificates.
2. Create a CertificateSigningRequest.

openssl genrsa -out home-admin.key 2048 # Generates ssl key
openssl req -new -key home-admin.key -out home-admin.csr -subj "/CN=home-admin" # Generates a Create a CertificateSigningRequest/ CSR
# or
openssl req -new -key home-admin.key -out home-admin.csr -subj "/CN=home-admin/O=system:admin" # Generates a CertificateSigningRequest (CSR)

• The additional part, /O=system:admin, is an Organization field that is commonly used to indicate that the certificate is for an admin-level user. system:admin is a special value used in Kubernetes to denote administrative access.

3. In the directory client_certificates pass the command.

tree

output two files:

├── home-admin.crt
├── home-admin.csr

Place your request with k8s and verify

1. Create a script csr-script.sh and got to kubernetes CSR instructions and paste the CSR manifest in the script.

2. Replace request: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVF with your on which you need to generate from the home-admin.csr.

cat | base64 home-admin.csr | tr -d "\n" #to generate "request: key in base64 format.

3. Run the script and check.

kubectl get csr # the status of the certificate should be pending

4. Approve the CSR

kubectl certificate approve home-admin # now check again and the status should bee approved

5. Extract the certificate for home-admin in text format decoded from base64.

kubectl get csr home-admin -o jsonpath='{.status.certificate}'| base64 -d > home-admin.crt

• Now you should have the following files in the client_certificates:

.
├── csr-script.sh
├── home-admin.crt
├── home-admin.csr
└── home-admin.key

Create the home-admin certificate

1. Copy the existing certificate in .kube/conf to a separate location and rename to k8s-local.conf.
2. Open with a text editor and modify as follows.
3. You will see three certificates:

• certificate-authority-data
• client-certificate-data
• client-key-data

5. Keep the certificate-authority-data unchanged!

6. Under server: https://192.x.x.x change the following with home-admin.

7. Change - client-certificate-dataand client-key-data by deleting the certificates.

8. Encode

├── home-admin.crt in format base64
├── home-admin.csr in format base64

Replace client-certificate-dataand client-key-data with the newly generated ones.

  cat | base64 home.crt | tr -d "\n"
  cat | base64 home.key | tr -d "\n"

Create ClusterRole and ClusterRoleBinding

1. Create the ClusterRole and ClusterRoleBinding manifest crole-crbinding.yaml.

.
├── crole-crbinding.yaml
├── csr-script.sh
├── home-admin.crt
├── home-admin.csr
└── home-admin.key

2. Paste the content:

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: home-admin
rules:
- apiGroups: [""]
  resources: ["*"]
  verbs: ["*"]

---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: home-admin
subjects:
- kind: User
  name: home-admin
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: home-admin
  apiGroup: rbac.authorization.k8s.io

3. Check CR, CRB

kubectl get clusterrole
kubectl get clusterrolebinding

4. Move the new k8s-local.conf file to your laptop ~/.kube/k8s-local.conf.
5. In laptop ~/.bashrc paste on the bottom export KUBECONFIG=~/.kube/k8s-local.conf

• Setting the KUBECONFIG environment variable is crucial for kubectl to know how to connect to the right Kubernetes cluster, user, and context. It allows you to easily switch between different Kubernetes configurations, making access management more flexible and efficient.
• For multiple cluster access see documentation.

source ~/.bashrc

• Make sure you have kubectl installed and run from your laptop.

kubectl get pods -A