5

So I've gone through the process of generating an RSA key, creating the YAML for a CSR, using kubectl to create a CSR in Minikube, approved the certificate.

However, when I try to download the certificate using kubectl get csr my-csr -o jsonpath='{.status.certificate}' I'm getting an empty result.

When I do a kubectl get csr my-csr -o yaml to get more information, this is what I see:

status:
  conditions:
  - lastUpdateTime: "2020-01-17T20:17:20Z"
    message: This CSR was approved by kubectl certificate approve.
    reason: KubectlApprove
    type: Approved

I'm expecting a certificate attribute with a base64 encoded string to which I will decode to obtain the certificate for client certificate validation. Can someone please tell me what I'm doing wrong?

For more context, I'm trying to follow the instructions in this tutorial

BMW
  • 42,880
  • 12
  • 99
  • 116
Alex
  • 1,293
  • 1
  • 13
  • 26

5 Answers5

4

I got similar problem. When I check with the following command:

kubectl get svc

It seems that the status of the csr is approved, but not issued. Any idea how to fix it?

[Updated] I found the problem. It is because the kube-controller-manager missed these options:

--cluster-signing-cert-file and --cluster-signing-key-file

Ricky Wong
  • 91
  • 3
2

For my case, I had a typo error

WithTypo: signerName: kubernetes.io/kube-apisever-client

WithoutTypo: signerName: kubernetes.io/kube-apiserver-client

and have the same result. csr was approved and certificate was not issued. It was resolved after I corrected the typo error.

TechDog
  • 3,039
  • 1
  • 24
  • 30
Jack Liu Shurui
  • 540
  • 1
  • 5
  • 14
1

Since CSR is not namespace specific, the command looks fine. I did the same to get the certificate, check you provide the proper csr name properly.

Secondly, if you didn't provide the name, and try to get all csr detail, you need change the key structure with additional .items[*]

kubectl get csr -o jsonpath='{.items[*].status.certificate}'

I have the feeling, you missed the csr name my-csr or the name is not really matched the search (typo?). Double check it.

BMW
  • 42,880
  • 12
  • 99
  • 116
1

This error must come. From the docs

Permitted subjects - organizations are exactly ["system:nodes"], common name starts with "system:node:".

So the solution is to add subjects O=system:nodes and appending "system:node:" to your servicename in cert generation.

For ex. openssl req -new -key server.key -out server.csr -subj "/O=system:nodes/CN=system:node:colortokens-bgl.csp.svc" -config server.conf

1

Verify your controller manager config, the Controller manager must be provided with --cluster-signing-cert-file and --cluster-signing-key-file config in-order to sigh the csr.

https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/#kube-controller-manager-configuration

ex:

apiVersion: kubeadm.k8s.io/v1beta3
kind: ClusterConfiguration
controllerManager:
  extraArgs:
    cluster-signing-cert-file: /etc/kubernetes/pki/ca.crt
    cluster-signing-key-file: /etc/kubernetes/pki/ca.key
Balaji P
  • 11
  • 1