User creation does not work

[medoedoff]

K3s Version:
k3s version v1.27.4+k3s1 (36645e7)

I wrote a script to create a k3s user:

#!/bin/bash

user=$1
group=$2
keyName="$1.key"
csrName="$1.csr"
certName="$1-client.crt"

openssl genpkey -out $keyName -algorithm ed25519
cat $keyName

echo

openssl req -new -key $keyName -out $csrName -subj "/CN=$user/O=$group"
cat $csrName

cat <<EOF | kubectl create -f -
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: $user
spec:
  signerName: kubernetes.io/kube-apiserver-client
  groups:
  - system:authenticated
  request: $(cat $csrName | base64 | tr -d '\n')
  signerName: kubernetes.io/kube-apiserver-client
  expirationSeconds: 31536000
  usages:
  - key encipherment
  - client auth
EOF

echo
echo "Approving signing request."

kubectl certificate approve $user

echo
echo "Downloading certificate." 
kubectl get csr $user -o jsonpath='{.status.certificate}' \
    | base64 --decode > $certName

cat <<EOF > ~/.kube/k3s-config
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: redacted
    server: https://kub-00:6443
  name: k3s-dev
EOF

kubectl --kubeconfig ~/.kube/k3s-config config set-credentials $user --client-key=$keyName --client-certificate=$certName --embed-certs
kubectl --kubeconfig ~/.kube/k3s-config config set-context $user  --cluster=k3s-dev --user=$user 
kubectl --kubeconfig ~/.kube/k3s-config config use-context $user 

./add-user.sh argocd robot

Script works well, I created Role and RoleBinding:

---

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: argocd
  name: argocd-ci-role
rules:
- apiGroups: ["argoproj.io"]
  resources: ["applications"]
  verbs: ["create", "update", "get", "patch"]
  
  ---
  
  apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: argocd-ci-role-binding
  namespace: argocd
subjects:
- kind: User
  name: argocd
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: Role
  name: argocd-ci-role
  apiGroup: rbac.authorization.k8s.io

Trying to test, that the user has a correct permissions
➜ kubectl --kubeconfig ~/.kube/k3s-config -n argocd get applications
Error from server (Forbidden): applications.argoproj.io is forbidden: User "argocd" cannot list resource "applications" in API group "argoproj.io" in the namespace "argocd"

Prove that user cert is signed and approved

kubectl get csr argocd                                           
NAME     AGE   SIGNERNAME                            REQUESTOR      REQUESTEDDURATION   CONDITION
argocd   65m   kubernetes.io/kube-apiserver-client   system:admin   365d                Approved,Issued

kubectl get csr argocd -o jsonpath='{.status.certificate}' | base64 --decode | openssl x509 -noout -text -in /dev/stdin
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            5e:b3:02:0b:5c:e6:56:44:c8:16:ee:69:21:88:e3:71
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: CN = k3s-client-ca@1692019168
        Validity
            Not Before: Sep 18 12:52:52 2023 GMT
            Not After : Sep 17 12:52:52 2024 GMT
        Subject: O = robot, CN = argocd
        Subject Public Key Info:
            Public Key Algorithm: ED25519
                ED25519 Public-Key:
                pub:
                    67:50:8d:bf:99:93:8c:c0:0a:9b:49:f4:42:08:ee:
                    cd:cc:26:cb:bc:56:b1:06:8f:30:87:25:4f:7d:c8:
                    16:63
        X509v3 extensions:
            X509v3 Key Usage: critical
                Key Encipherment
            X509v3 Extended Key Usage: 
                TLS Web Client Authentication
            X509v3 Basic Constraints: critical
                CA:FALSE
            X509v3 Authority Key Identifier: 
                08:9B:45:A3:8B:8F:8F:D3:06:2A:DB:A0:DC:29:D8:96:5E:CC:EE:85
    Signature Algorithm: ecdsa-with-SHA256
    Signature Value:
        30:45:02:21:00:cc:28:05:f4:5b:bc:e4:e7:36:d9:00:13:19:
        40:6b:a0:da:05:6f:20:9a:01:b2:b2:58:83:9a:22:10:e9:fc:
        00:02:20:3e:a5:83:e7:9d:4b:67:37:cc:32:08:57:5b:a5:ed:
        03:a0:f8:57:3f:93:7b:53:2e:34:49:a3:a6:ee:7b:06:ae

What am I doing wrong?

[sylvainfaivre]

Hi, I have limited k3s experience, but this command might help you to check which authorizations are effective for your new user :
kubectl [...] auth can-i --list=true

(compare the output to the one you get with your admin user)