View difference between Paste ID: ixw3DsJF and gypy9pvt

 ---make sure you have openssl installed
 openssl genrsa -out bwagoner.pem 2048
 ----The CN in the next line is how you will be referenced in kubernetes rolebindings.
 openssl req -new -key bwagoner.pem -out bwagoner.csr -subj "/CN=bwagoner"
 ----If you want the user to be part of some groups, the previous line would look something like-----
 openssl req -new -key bwagoner.pem -out bwagoner.csr -subj "/CN=bwagoner/O=app1/O=app2"
 
 cat bwagoner.csr | base64 | tr -d '\n'
 
 vi bwagoner.req
 
 apiVersion: certificates.k8s.io/v1beta1
 kind: CertificateSigningRequest
 metadata:
   name: user-request-bwagoner
 spec:
   groups:
   - system:authenticated
-  request: paste base 64 csr here
+  request: paste base 64 csr here from the cat bwagoner.csr line
   usages:
   - digital signature
   - key encipherment
   - client auth
 
 kubectl create -f bwagoner.req
 kubectl get csr
 kubectl certificate approve user-request-bwagoner
 kubectl get csr user-request-bwagoner -o jsonpath='{.status.certificate}' | base64 -d > bwagoner.crt
 
-copy existing kubeconfig and replace user info with these or create all new kubeconfig:
+copy existing kubeconfig and replace "client-certificate-data:" and "client-key-data:" with these respectively:
 cat bwagoner.crt |base64 |tr -d '\n'
 cat bwagoner.pem |base64 |tr -d '\n'
 
-alternately create new kubeconfig:
+Also change username and name fields accordingly in that new kubeconfig file. those fields only really effect the local kubeconfig file and are not the usernames used by kubernetes. give new kubeconfig to client.
-kubectl --kubeconfig ~/.kube/config-jakub config set-cluster jakub --insecure-skip-tls-verify=true --server=https://api.my-cluster.dev.dbgcloud.io
+
-kubectl --kubeconfig ~/.kube/config-jakub config set-credentials jakub --client-certificate=jakub.crt --client-key=jakub.pem --embed-certs=true
+
-kubectl --kubeconfig ~/.kube/config-jakub config set-context jakub --cluster=jakub --user=jakub
+
-kubectl --kubeconfig ~/.kube/config-jakub config use-context jakub
+
 kubectl create rolebinding bwagoner --clusterrole=admin --user=bwagoner --dry-run -o yaml
 kubectl create rolebinding bwagoner --clusterrole=admin --user=bwagoner
 
 -----optional: limit user to one namespace--------
 kubectl create namespace foo
 
 vi test.yml
 
------optional: limit to one namespace--------
+
 apiVersion: v1
 kind: Role
 apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: limited-to-foo-namespace
   namespace: foo
 rules:
 - apiGroups: ["", "extensions", "apps"]
   resources: ["*"]
   verbs: ["*"]
 - apiGroups: ["batch"]
   resources:
   - jobs
   - cronjobs
   verbs: ["*"]
 
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1beta1
 metadata:
   name: limited-to-foo-binding
   namespace: foo
 subjects:
 - kind: User
   name: bwagoner
   namespace: foo
 roleRef:
   apiGroup: rbac.authorization.k8s.io
   kind: Role
   name: limited-to-foo-namespace
 
 kubectl create -f test.yml
 
 --------if you don't want to have to specify the locked down namespace in every command on the client side then update your kubeconfig file----
 kubectl config set-context $(kubectl config current-context) --namespace=foo