How add users in Microk8s ?

MicroK8s is a minimal, low-operations Kubernetes designed for production environments. As an open-source platform, it automates the deployment, scaling, and management of containerized applications. It includes core Kubernetes components with a small footprint and can scale from a single node to a high-availability production cluster. Essentially, MicroK8s offers production-grade support for all key Kubernetes features, including advanced networking and storage configurations.

In this post, we will create a user for microk8s cluster apart from it's default admin user, create a kubeconfig file for the user and use it in kubectl to access the cluster. This is important for a devops engineer to create separate user with appropriate RBAC to insure that a user can access only the required resources in the cluster.

Make sure you have microk8s running in your system, if not you can install it by running the following command.

sudo snap install microk8s --classic

Now we will create user credentials, microk8s uses kubeconfig files to manage user credentials.

We will use "openssl" to generate certificate and key for the new user. Replace "username" with the desired username.

openssl genrsa -out username.key 2048 openssl req -new -key username.key -out username.csr -subj "/CN=username/O=group" openssl x509 -req -in username.csr -CA /var/snap/microk8s/current/certs/ca.crt -CAkey /var/snap/microk8s/current/certs/ca.key -CAcreateserial -out username.crt -days 365 

After this, we are now going to create the kubeconfig file for the new user.
Replace the username, cluster-name and cluster-server with appropriate values.

apiVersion: v1 kind: Config clusters: - cluster: certificate-authority: /var/snap/microk8s/current/certs/ca.crt server: https://<cluster-server>:16443 name: <cluster-name> contexts: - context: cluster: <cluster-name> user: username name: username-context current-context: username-context users: - name: username user: client-certificate: /path/to/username.crt client-key: /path/to/username.key 

Create a role and role binding for the new user in Kubernetes. For example, you can create a role that grants read-only access to all resources in a namespace.

apiVersion: rbac.authorization.k8s.io/v1 kind: Role metadata: namespace: default name: read-only rules: - apiGroups: [""] resources: ["pods", "services", "deployments"] verbs: ["get", "list", "watch"] 

Then, create a role binding to bind the role to the new user

apiVersion: rbac.authorization.k8s.io/v1 kind: RoleBinding metadata: name: read-only-binding namespace: default subjects: - kind: User name: username apiGroup: rbac.authorization.k8s.io roleRef: kind: Role name: read-only apiGroup: rbac.authorization.k8s.io 

You can also create a cluster role and cluster role binding to provide the user cluster wide access.

Apply the above RBAC configuration using kubectl

microk8s kubectl apply -f role.yaml microk8s kubectl apply -f rolebinding.yaml 

Provide the generated kubeconfig file to the new user. The user can then use this file to access the Kubernetes cluster with the permissions defined by the RBAC configuration.