cert-auth is a service designed to make it easy to issue signed client certificates for Kubernetes.
It is recommended to use cert-auth with oauth2-proxy for authentication and to use mutual TLS to authenticate oauth2-proxy and cert-auth.
As the Kubernetes API does not allow specifying the expiration of certificates, all certificates are valid for one year - use RBAC to revoke a user's access.
There are two ways to use cert-auth.
It can be used as a CLI:
cert-auth -subject username -api-server https://k8s-api.example.com/ > kubeconfig.yaml
KUBECONFIG=kubeconfig.yaml kubectl get nodes
It can also be used as an API:
kubectl create configmap cert-auth --from-literal=endpoint=https://k8s-api.example.com/
kubectl apply -f ./deploy.yaml
Create an Ingress record for the service and then you can fetch a kubeconfig from it:
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: cert-auth
annotations:
certmanager.k8s.io/cluster-issuer: letsencrypt
spec:
rules:
- host: kube.example.com
http:
paths:
- path: /
backend:
serviceName: cert-auth
servicePort: cert-auth
tls:
- hosts:
- kube.example.com
secretName: kube-cert
Fetch with curl:
curl https://kube.example.com/ -H 'X-Forwarded-User: username' > kubeconfig.yaml
See this documentation for details on setup with oauth2-proxy.
The certificates that are issued are issued for the subject or X-Auth-User
provided, so the permissions can be restricted using Kubernetes RBAC.
For example, to make username
a cluster-admin:
apiVersion: rbac.authorization.k8s.io/v1beta1
kind: ClusterRoleBinding
metadata:
name: admins
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: ClusterRole
name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
kind: User
name: username
Without an RBAC policy set, a user has no permissions by default.
- kubehook is a similar design and inspiration for this project, but uses Kubernetes webhook authentication, which requires setting flags on the Kubernetes API server. In some environments (Digital Ocean managed Kubernetes), this is not possible.