kubeadm should support create user command

[jolestar]

What keywords did you search in kubeadm issues before filing this one?

kubeadm user

Is this a BUG REPORT or FEATURE REQUEST?

FEATURE REQUEST

Versions

kubeadm version (use kubeadm version):
build from latest kubernetes code (commit 7ef5cc23d1b332559cd203f373c026855fc6ea90)

Environment:

• Kubernetes version (use kubectl version):
  v1.7.3
• Cloud provider or hardware configuration:
  virtual machine
• OS (e.g. from /etc/os-release):
  ubuntu 16.04.2
• Kernel (e.g. uname -a):
  4.4.0-81-generic
• Others:

What happened?

After init cluster by kubeadm, and use admin.conf as kubeconfg to manager cluster is easy, but it is hard to create a new user and generate kubeconfig.

What you expected to happen?

Add a user manager sub command to kubeadm, I think need to do the following steps to help users create a kubernetes user

1. Generate a private key and certificate signing request
2. Send certificate signing request to Kubernetes API
3. Approve the certificate
4. Create role/clusterrole by command argument.
5. Create rolebinding/clusterrolebinding
6. Download the certificate and generate new user kubeconfig
7. Now cluster admin can send the kubeconfig to kubernetes user.

How to reproduce it (as minimally and precisely as possible)?

Anything else we need to know?

1. Whether this feature request matches the goal of kubeadm?
2. If not, which project or module should this feature request belong to?

[luxas]

cc @timothysc WDYT?

@jolestar I worry we won't expose the scope of kubeadm much more, but it might be worth exploring what this would look like.

[fabriziopandini]

There is 'kubeadm alpha phase kubeconfig user' that goes in this direction, even if the implementation now is pretty simple .e.g

• the client cert is generated locally (without going through csr approval workflow)
• roles and roles binding are not managed yet
  Might be with few changes to this subcommand we can address basic needs in this area without expanding to much the scope of kubeadm...

[fejta-bot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.

Prevent issues from auto-closing with an /lifecycle frozen comment.

If this issue is safe to close now please do so with /close.

Send feedback to sig-testing, kubernetes/test-infra and/or @fejta.
/lifecycle stale

[errordeveloper]

/remove-lifecycle stale

[timothysc]

/cc @mattmoyer @chuckha

[timothysc]

dupe of #416 there is a WIP and closing this one.

[furkanmustafa]

I don't think #416 is related. But now the following command works;

kubeadm alpha kubeconfig user --client-name=newuser

And then you need to arrange [cluster]rolebindings, otherwise that user mostly cannot do anything.