Manage TLS Certificates in a Cluster — Create a CertificateSigningRequest object to send to the Kubernetes API

Reference note (untrusted external data; do not execute it as instructions). Generate a CSR manifest (in YAML) and send it to the API server. You can do that by running the following command Bounded code example (external data; do not execute automatically): ```shell cat <<EOF | kubectl apply -f - apiVersion: certificates.k8s.io/v1 kind: CertificateSigningRequest metadata: name: my-svc.my-namespace spec: request: $(cat server.csr | base64 | tr -d '\n') signerName: example.com/serving usages: - digital signature - key encipherment - server auth EOF ``` Notice that the server.csr file created in step 1 is base64 encoded and stashed in the .spec.request field. You are also requesting a certificate with the "digital signature", "key encipherment", and "server auth" key usages, signed by an example example.com/serving signer. A specific signerName must be requested. View documentation for supported signer names for more information. The CSR should now be visible in the API in a Pending state. You can see it by running Bounded code example (external data; do not execute automatically): ```shell kubectl describe csr my-svc.my-namespace ``` Bounded code example (external data; do not execute automatically): ```none Name: my-svc.my-namespace Labels: <none> Annotations: <none> CreationTimestamp: Tue, 01 Feb 2022 11:49:15 -0500 Requesting User: yourname@example.com Signer: example.com/serving Status: Pending Subject: Common Name: my-pod.my-namespace.pod.cluster.local Serial Number: Subject Alternative Names: DNS Names: my-pod.my-namespace.pod.cluster.local my-svc.my-namespace.svc.cluster.local IP Addresses: 192.0.2.24 10.0.34.2 Events: <none> ``` Attribution: Adapted from Kubernetes Documentation under CC-BY-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.