k8s runtime Csr

Kubernetes (k8s) uses Certificate Signing Requests (CSRs) to authenticate and authorize access to resources running on the Kubernetes cluster. A CSR is a request for a digital certificate that is signed by a Certificate Authority (CA). The Kubernetes API server uses CSRs to generate client certificates that are used to authenticate and authorize access to the cluster.

When a Kubernetes user or service account requests access to a resource, the API server checks the user's or service account's credentials and permissions, and then generates a CSR for them. The CSR is sent to the CA, which verifies the user's or service account's identity and signs the certificate. The signed certificate is then returned to the API server, which stores it in a secret object.

The Kubernetes runtime uses these certificates to authenticate and authorize access to the resources running on the cluster. This ensures that only authorized users and services can access the resources and that the cluster is secure.