# How to create user to autheticate with microk8s outside of cluster?

**URL:** <https://discuss.kubernetes.io/t/how-to-create-user-to-autheticate-with-microk8s-outside-of-cluster/11030>\
**Category:** microk8s\
**Created:** [May 20, 2020, 8:41pm UTC](https://discuss.kubernetes.io/t/how-to-create-user-to-autheticate-with-microk8s-outside-of-cluster/11030 "2020-05-20T20:41:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![TristanStanic](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/tristanstanic/32/5148_2.png) [@TristanStanic](https://discuss.kubernetes.io/u/TristanStanic)\
**Post date:** [May 20, 2020, 8:41pm UTC](https://discuss.kubernetes.io/t/how-to-create-user-to-autheticate-with-microk8s-outside-of-cluster/11030/1 "2020-05-20T20:41:19Z")

</div>

Using microk8s on Ubuntu 20.04

Among the data returned by [microk8s config](https://microk8s.io/docs/commands#heading--microk8s-config) there is

```auto
- name: admin
  user:
    username: admin
    password: S05BcnhqaWpCNzlRaWtDZEIzNHEzVU5qKzZCaERUbWxjQ2d6VTFmcjkrQT0K

```

I suppose the `admin` user has been created (silently) by microk8s installer.

Q1. Is that `admin` user manageable? For example, is there a way to change the pwd?

Q2. Can you give an example where we would need to refer to that `admin` user? I don’t know if I am doing the right thing. Currently to use `kubectl` outside of the cluster (on a machine in the same subnet), I added that user by [kubectl config set-credentials](https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#-em-set-credentials-em-)

Q3. Like Q2, using `kubectl` from outside the cluster, instead of using the `admin` user. I’d like to use another user. That new user can create/delete resources but not admin tasks on the microk8s cluster. How should I create that user?

---

<div class="post-metadata">

**Author:** ![kjackal](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/kjackal/32/1750_2.png) [@kjackal](https://discuss.kubernetes.io/u/kjackal)\
**Post date:** [May 21, 2020, 7:22am UTC](https://discuss.kubernetes.io/t/how-to-create-user-to-autheticate-with-microk8s-outside-of-cluster/11030/2 "2020-05-21T07:22:26Z")

</div>

> [@TristanStanic](#):
>
> Q1. Is that `admin` user manageable? For example, is there a way to change the pwd?

The admin user is created during installation. That user is authenticated through a token as described in [1]. To change the token you will need to edit the `/var/snap/microk8s/current/credentials/known_tokens.csv` file.

> [@TristanStanic](#):
>
> Q2. Can you give an example where we would need to refer to that `admin` user? I don’t know if I am doing the right thing. Currently to use `kubectl` outside of the cluster (on a machine in the same subnet), I added that user by [kubectl config set-credentials](https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#-em-set-credentials-em-)

That is fine. Another popular approach is to have multiple kubeconfig files (even merged) and select the one you want as described in [2]

> [@TristanStanic](#):
>
> Q3. Like Q2, using `kubectl` from outside the cluster, instead of using the `admin` user. I’d like to use another user. That new user can create/delete resources but not admin tasks on the microk8s cluster. How should I create that user?

You would first need to create a new user. There are a few authentication mechanisms described in [1]. MicroK8s comes with the static-tokens-file and X509 Client Certs enabled by default. The easiest is to edit the `known_tokens.csv` to add a new user. You should appoint that user to some groups (also in the `known_tokens.csv` file). Afterwards you will need to enable RBAC [3] to restrict the permissions of that user. Enabling RBAC is done with `microk8s enable rbac`.

[1] [Authenticating | Kubernetes](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#static-token-file)  
[2] [Organizing Cluster Access Using kubeconfig Files | Kubernetes](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/)  
[3] [Using RBAC Authorization | Kubernetes](https://kubernetes.io/docs/reference/access-authn-authz/rbac/)