Identity & Access · wrap-up
Cheat sheet & self-check
Every command from this section on one page.
Inspect certificates
sudo kubeadm certs check-expiration | Expiry of every kubeadm-managed certificate |
openssl x509 -in cert.crt -noout -subject -issuer -enddate | Who, signed by whom, valid until |
openssl x509 -in apiserver.crt -noout -ext subjectAltName | Names and IPs the API server cert is valid for |
echo | openssl s_client -connect <host>:6443 2>/dev/null | openssl x509 -noout -dates | Check a live endpoint's certificate |
Kubelet certificates
ls -l /var/lib/kubelet/pki/ | kubelet client/serving certs on a node |
kubectl get csr | Certificate signing requests (e.g. kubelet serving certs) |
kubectl certificate approve <csr> | Approve a pending CSR (after checking it!) |
Install & inspect
helm repo add jetstack https://charts.jetstack.io | Add the cert-manager chart repository |
helm install cert-manager jetstack/cert-manager -n cert-manager --create-namespace --set crds.enabled=true | Install with CRDs (older charts: installCRDs=true) |
kubectl get clusterissuers,issuers -A | Configured issuers and their readiness |
kubectl get certificate -A | Certificates, Ready status and secret names |
kubectl describe certificate <name> | Events: why it isn't issued yet |
kubectl get certificaterequests,orders,challenges -A | The issuance pipeline (ACME) |
Who am I?
kubectl auth whoami | Username and groups the API server sees |
kubectl config view --minify | The user entry kubectl is using |
Client certificate via the CSR API
openssl genrsa -out asha.key 2048 | A private key |
openssl req -new -key asha.key -subj "/CN=asha/O=devops" -out asha.csr | CN = username, O = group |
kubectl certificate approve asha | Approve the CertificateSigningRequest |
kubectl get csr asha -o jsonpath='{.status.certificate}' | base64 -d > asha.crt | Fetch the signed certificate |
ServiceAccount tokens
kubectl create token app -n shop --duration=1h | A short-lived token for a ServiceAccount |
cat /var/run/secrets/kubernetes.io/serviceaccount/token | The projected token inside a pod |
API server (kube-apiserver flags)
--oidc-issuer-url=https://sso.example.com/realms/platform | Who issues the tokens (must be HTTPS) |
--oidc-client-id=kubernetes | The audience (client) tokens must be issued for |
--oidc-username-claim=email --oidc-username-prefix=oidc: | Which claim becomes the username (with a prefix) |
--oidc-groups-claim=groups --oidc-groups-prefix=oidc: | Which claim holds group membership |
kubectl side (kubelogin)
kubectl krew install oidc-login | Install kubelogin as a kubectl plugin |
kubectl oidc-login setup --oidc-issuer-url=… --oidc-client-id=kubernetes | Test the login and print the claims |
kubectl auth whoami | Confirm username and groups |
Design checklist
One source of identity | Enterprise IdP (Entra ID, Okta, Google…) for every cluster |
Broker when needed | Keycloak/Dex/Pinniped federate the IdP to many clusters |
MFA at the IdP | Kubernetes never sees passwords or second factors |
Short tokens | Minutes, refreshed by the IdP; faster offboarding |
Break-glass | Offline, sealed, monitored credentials: rotated after every use |
Useful commands
kubectl auth whoami | Confirm who you're logged in as |
sudo kubeadm kubeconfig user --client-name=breakglass-2026q3 --org=kubeadm:cluster-admins | Generate a separate emergency admin kubeconfig (kubeadm) |
Review access
kubectl auth can-i --list --as=oidc:asha@example.com --as-group=oidc:developers -n shop | Everything a user+group may do in a namespace |
kubectl get clusterrolebindings -o wide | Cluster-wide grants and their subjects |
kubectl who-can get secrets -n shop | Who can read secrets (kubectl-who-can plugin) |
kubectl get clusterroles -l rbac.authorization.k8s.io/aggregate-to-edit=true | Roles aggregated into 'edit' |
Dangerous verbs & resources
secrets: get/list/watch | Read every credential in scope |
pods: create (any) | Run as any ServiceAccount in that namespace, mount its Secrets |
bind / escalate on roles | Grant yourself more than you have |
impersonate | Act as another user or group |
nodes/proxy, pods/exec | Reach into nodes or containers |
