Script to mint k8s user certificates and concatenate them into a single config

get-kubeconfig

#!/bin/bash
set -eu -o pipefail

REQUEST_ID=$(uuidgen)
BASE64_DECODE_FLAG="-D"
BASE64_WRAP_FLAG=""
CLUSTER_NAME=$1

mkdir -p build
mkdir -p ~/.kube/configs/
pushd build
cat > csr <<EOF
{
  "hosts": [],
  "CN": "${CLUSTER_NAME}-${USER}",
  "names": [
    {
      "O": "system:masters"
    }
  ],
  "key": {
    "algo": "ecdsa",
    "size": 256
  }
}
EOF

cat csr | cfssl genkey - | cfssljson -bare server

cat <<EOF | kubectl create -f -
apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
  name: ${REQUEST_ID}
spec:
  groups:
  - system:authenticated
  request: $(cat server.csr | base64 | tr -d '\n')
  usages:
  - digital signature
  - key encipherment
  - server auth
EOF
kubectl certificate approve ${REQUEST_ID}

kubectl get csr ${REQUEST_ID} -o jsonpath='{.status.certificate}' \
  | base64 ${BASE64_DECODE_FLAG} > server.crt

CLUSTER_DNS=$(kubectl get pods -n kube-system -l k8s-app=kube-dns -o jsonpath='{.items[0].metadata.name}')

if [[ $CLUSTER_DNS == "coredns"* ]]; then
  kubectl -n kube-system exec ${CLUSTER_DNS} -c coredns -- /bin/cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt > ca.crt
else
  kubectl -n kube-system exec ${CLUSTER_DNS} -c kubedns -- /bin/cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt > ca.crt
fi

# Case we're running coreDNS instead
if [ "$?" -eq "0" ]; then
  kubectl -n kube-system exec $(kubectl get pods -n kube-system -l k8s-app=kube-dns -o jsonpath='{.items[0].metadata.name}') -c coredns -- /bin/cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt > ca.crt
fi

# Extract cluster IP from the current context
CURRENT_CONTEXT=$(kubectl config current-context)
CURRENT_CLUSTER=$(kubectl config view -o jsonpath="{.contexts[?(@.name == \"${CURRENT_CONTEXT}\"})].context.cluster}")
CURRENT_CLUSTER_ADDR=$(kubectl config view -o jsonpath="{.clusters[?(@.name == \"${CURRENT_CLUSTER}\"})].cluster.server}")

cat > ~/.kube/configs/${CLUSTER_NAME} <<EOF
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: $(cat ca.crt | base64 ${BASE64_WRAP_FLAG})
    server: ${CURRENT_CLUSTER_ADDR}
  name: ${CLUSTER_NAME}
contexts:
- context:
    cluster: ${CLUSTER_NAME}
    user: ${CLUSTER_NAME}-${USER}
  name: ${CLUSTER_NAME}
current-context: ${CLUSTER_NAME}
kind: Config
preferences: {}
users:
- name: ${CLUSTER_NAME}-${USER}
  user:
    client-certificate-data: $(cat server.crt | base64 ${BASE64_WRAP_FLAG})
    client-key-data: $(cat server-key.pem | base64 ${BASE64_WRAP_FLAG})
EOF

popd

rm -rf build

KUBECONFIG=$(realpath ~/.kube/configs/* | paste -sd ":" - ) kubectl config view --merge --flatten > ~/.kube/config

Usage:

$ get-kubeconfig

2019/03/05 11:04:21 [INFO] generate received request
2019/03/05 11:04:21 [INFO] received CSR
2019/03/05 11:04:21 [INFO] generating key: ecdsa-256
2019/03/05 11:04:21 [INFO] encoded CSR
certificatesigningrequest.certificates.k8s.io/DDDDDDDD-3333-4444-CCAA-UUID created
certificatesigningrequest.certificates.k8s.io/DDDDDDDD-3333-4444-CCAA-UUID approved
$

References:

• https://ahmet.im/blog/mastering-kubeconfig/
• https://gravitational.com/blog/kubectl-gke/
• https://github.com/gravitational/teleport/blob/master/examples/gke-auth/get-kubeconfig.sh

Added a little bit of logic to address wether you're runnig coreDNS or kubeDNS