List the User subjects already bound to cluster-admin via kubectl get clusterrolebinding.
The name is distribution specific: cluster-admin on kubeadm, clusterAdmin and clusterUser on AKS.
Create a CSR using a CN matching one of those usernames and request the kubernetes.io/kube-apiserver-client signer.
Approve the CSR.
This requires both update on certificatesigningrequests/approval and approve on signers for that exact signerName.
The built-in signing controller issues a real, CA-signed certificate automatically.
No CA key or extra access is needed from the caller.
The cert authenticates as the matched username, inheriting all its RBAC permissions.
It works until expiry.
Individual revocation requires CA rotation.
Rights needed:
- T2create certificatesigningrequests+T2update certificatesigningrequests/approval+T2approve signers+T3get certificatesigningrequests
· scoped to signerName kubernetes.io/kube-apiserver-client
· no CA key needed
Note:
The CSR API remains dangerous for kube-apiserver client certificates, but the direct built-in system:masters request is rejected by signer policy.
Custom signers or certificates for other bound high-privilege identities can still be escalation paths.