Kubernetes RBAC Setup Using Certificates — Full Steps

Step 1 — Prepare Cluster CA

1. Identify your cluster CA certificate and key. On a Kops-managed cluster:

# CA cert
find /srv -name "ca.crt"
# CA key
find /srv -name "ca.key"

These are needed to sign user certificates.

Copy the CA cert and key to a secure location on your workstation or master node (we used /tmp/).

Step 2 — Create Namespaces

kubectl create ns dev
kubectl create ns prod
kubectl get ns

• dev → development namespace
• prod → production namespace

Step 3 — Generate User Certificates

For each user, generate a private key, CSR, and signed certificate.

Example: dev-user

# Generate private key
openssl genrsa -out dev-user.key 2048

# Generate CSR
openssl req -new -key dev-user.key -out dev-user.csr -subj "/CN=dev-user/O=dev-team"

# Sign CSR with CA
openssl x509 -req -in dev-user.csr \
  -CA /tmp/ca.crt -CAkey /tmp/ca.key -CAcreateserial \
  -out dev-user.crt -days 365

# Verify
openssl x509 -in dev-user.crt -text -noout

• Repeat for prod-user and ops-admin (cluster admin).
• CN = username, O = group/organization.

Step 4 — Create kubeconfig for each user

# Set cluster
kubectl config set-cluster randomtechy.tech \
  --server=<api-server-url> \
  --certificate-authority=/tmp/ca.crt \
  --kubeconfig=dev-user.kubeconfig \
  --embed-certs=true

# Set user
kubectl config set-credentials dev-user \
  --client-certificate=/tmp/dev-user.crt \
  --client-key=/tmp/dev-user.key \
  --kubeconfig=dev-user.kubeconfig \
  --embed-certs=true

# Set context
kubectl config set-context dev-user-context \
  --cluster=randomtechy.tech \
  --namespace=dev \
  --user=dev-user \
  --kubeconfig=dev-user.kubeconfig

# Switch to context
kubectl config use-context dev-user-context --kubeconfig=dev-user.kubeconfig

• Repeat for prod-user and ops-admin.
• ops-admin context can use default namespace since it’s cluster-wide.

Step 5 — Create Roles and ClusterRoles

Namespace-scoped Role (dev-user / prod-user)

dev-user-role.yaml:

kind: Role
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: dev-user-role
  namespace: dev
rules:
  - apiGroups: ["", "apps", "networking.k8s.io"]
    resources: ["pods", "deployments", "replicasets", "ingress", "services"]
    verbs: ["get", "list", "create", "update", "delete"]

• prod-user gets similar Role in prod namespace.

Cluster-scoped Role (ops-admin)

ops-admin-clusterrole.yaml:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cluster-admin-role
rules:
- apiGroups: ["*"]
  resources: ["*"]
  verbs: ["*"]

Step 6 — Create RoleBindings / ClusterRoleBindings

Namespace-scoped RoleBinding

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: dev-user-rolebinding
  namespace: dev
subjects:
- kind: User
  name: dev-user
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: dev-user-role
  apiGroup: rbac.authorization.k8s.io

• Repeat for prod-user in prod.

ClusterRoleBinding for ops-admin

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: ops-admin-binding
subjects:
- kind: User
  name: ops-admin
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: cluster-admin-role
  apiGroup: rbac.authorization.k8s.io

Step 7 — Apply RBAC YAMLs

kubectl apply -f dev-user-role.yaml
kubectl apply -f dev-user-rolebinding.yaml
kubectl apply -f prod-user-role.yaml
kubectl apply -f prod-user-rolebinding.yaml
kubectl apply -f ops-admin-clusterrole.yaml
kubectl apply -f ops-admin-clusterrolebinding.yaml

Step 8 — Smoke Test User Permissions

dev-user

kubectl --kubeconfig=dev-user.kubeconfig auth can-i create pods -n dev  # yes
kubectl --kubeconfig=dev-user.kubeconfig auth can-i get nodes              # no

prod-user

kubectl --kubeconfig=prod-user.kubeconfig auth can-i delete deployments -n prod  # yes
kubectl --kubeconfig=prod-user.kubeconfig auth can-i get pods -n dev              # no

ops-admin

kubectl --kubeconfig=ops-admin.kubeconfig get nodes
kubectl --kubeconfig=ops-admin.kubeconfig get pods --all-namespaces
kubectl --kubeconfig=ops-admin.kubeconfig auth can-i create clusterrole            # yes

Step 9 — (Optional) Merge kubeconfigs

export KUBECONFIG=/tmp/dev-user.kubeconfig:/tmp/prod-user.kubeconfig:/tmp/ops-admin.kubeconfig
kubectl config view --merge --flatten > /tmp/merged.kubeconfig
export KUBECONFIG=/tmp/merged.kubeconfig
kubectl config get-contexts
kubectl config use-context dev-user-context

✅ Now you can switch users quickly without juggling multiple kubeconfig files.

This completes the full hands-on RBAC setup from certificate creation → kubeconfigs → roles → bindings → smoke tests → merged kubeconfig.

Kubernetes RBAC Diagram (Users → Roles → Namespaces/Cluster)

Legend / Key

• User / ServiceAccount → CN in certificate → mapped to Role or ClusterRole
• Role → namespace-scoped, gives permissions only inside that namespace
• RoleBinding → assigns Role to a user within a namespace
• ClusterRole → cluster-wide permissions
• ClusterRoleBinding → assigns ClusterRole to a user across all namespaces

1. dev-user can only access the dev namespace resources.
2. prod-user can only access the prod namespace resources.
3. ops-admin can access everything cluster-wide.