kubeadm should support create user command

Created on 11 Aug 2017  ·  7Comments  ·  Source: kubernetes/kubeadm

What keywords did you search in kubeadm issues before filing this one?

kubeadm user

Is this a BUG REPORT or FEATURE REQUEST?

FEATURE REQUEST

Versions

kubeadm version (use kubeadm version):
build from latest kubernetes code (commit 7ef5cc23d1b332559cd203f373c026855fc6ea90)

Environment:

  • Kubernetes version (use kubectl version):
    v1.7.3
  • Cloud provider or hardware configuration:
    virtual machine
  • OS (e.g. from /etc/os-release):
    ubuntu 16.04.2
  • Kernel (e.g. uname -a):
    4.4.0-81-generic
  • Others:

What happened?

After init cluster by kubeadm, and use admin.conf as kubeconfg to manager cluster is easy, but it is hard to create a new user and generate kubeconfig.

What you expected to happen?

Add a user manager sub command to kubeadm, I think need to do the following steps to help users create a kubernetes user

  1. Generate a private key and certificate signing request
  2. Send certificate signing request to Kubernetes API
  3. Approve the certificate
  4. Create role/clusterrole by command argument.
  5. Create rolebinding/clusterrolebinding
  6. Download the certificate and generate new user kubeconfig
  7. Now cluster admin can send the kubeconfig to kubernetes user.

How to reproduce it (as minimally and precisely as possible)?

Anything else we need to know?

  1. Whether this feature request matches the goal of kubeadm?
  2. If not, which project or module should this feature request belong to?
areUX help wanted prioritbacklog triagduplicate
Source
picture jolestar

All 7 comments

cc @timothysc WDYT?

@jolestar I worry we won't expose the scope of kubeadm much more, but it might be worth exploring what this would look like.

luxas picture luxas on 14 Aug 2017
👍1

There is 'kubeadm alpha phase kubeconfig user' that goes in this direction, even if the implementation now is pretty simple .e.g

  • the client cert is generated locally (without going through csr approval workflow)
  • roles and roles binding are not managed yet
    Might be with few changes to this subcommand we can address basic needs in this area without expanding to much the scope of kubeadm...
fabriziopandini picture fabriziopandini on 8 Oct 2017

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

fejta-bot picture fejta-bot on 7 Jan 2018

/remove-lifecycle stale

errordeveloper picture errordeveloper on 22 Jan 2018

/cc @mattmoyer @chuckha

timothysc picture timothysc on 31 Jan 2018

dupe of #416 there is a WIP and closing this one.

timothysc picture timothysc on 7 Apr 2018

I don't think #416 is related. But now the following command works;

kubeadm alpha kubeconfig user --client-name=newuser

And then you need to arrange [cluster]rolebindings, otherwise that user mostly cannot do anything.

furkanmustafa picture furkanmustafa on 29 Aug 2019
👍1
Was this page helpful?
0 / 5 - 0 ratings

Related issues

imedaouidene picture imedaouidene  ·  3Comments
jessfraz picture jessfraz  ·  3Comments
kvaps picture kvaps  ·  3Comments
mattmoyer picture mattmoyer  ·  4Comments
helphi picture helphi  ·  3Comments