Question

A new developer, 'dana', needs kubectl access to your kubeadm-provisioned cluster. She has generated a private key and a CertificateSigningRequest (CSR) with CN=dana, and submitted it to the cluster as a Kubernetes CertificateSigningRequest object named 'dana-access'. When she runs 'kubectl get pods -n dev', she receives an error: 'error: You must be logged in to the server (Unauthorized)'. As the cluster admin, what is the correct sequence of steps to grant her working access?

Accepted Answer

Approve the CSR with 'kubectl certificate approve dana-access', retrieve the signed certificate from the CSR status, then create a Role and RoleBinding in the 'dev' namespace referencing the user 'dana'.

Answer

Create a ServiceAccount named 'dana' in the 'dev' namespace and bind it with a RoleBinding, then have her use the ServiceAccount token instead of the certificate.

Answer

Add 'dana' to the system:masters group in the kube-apiserver static pod manifest and restart the API server.

Answer

Approve the CSR with 'kubectl certificate approve dana-access', which automatically grants her full cluster access once the certificate is issued.