You can use the build in CA in your cluster to create client certificates.

Background information on how to use the CA: cluster-administration-certificates.

Steps to reproduce:

1. Make sure that you have created JSON user configuration file

Example JSON file:

{
    "CN": "example-user",
    "key": {
        "algo": "rsa",
        "size": 4096
    },
    "names": [{
        "O": "example-user",
        "email": "some@email"
    }]
}

1. Generate CSR for it
2. Use kubectl command to submit a CSR
3. the request field is base64 encoded version of your csr file
4. View your CSR, execute command: kubectl get csr
5. Approve CSR, execute command: kubectl certificate approve example-user
6. Decode certificate,execute command: kubectl get csr example-user -o jsonpath='{.status.certificate}' | base64 -d > client.pem
7. You can now use the client-key.pem and client.pem to build a kubeconfig
8. You can then create RBAC rolebindings on your cluster assigning to either –user=example-user or –group=example-user (assuming you used “O”: “example-user” is defined in this example)

Here you can find more information: certificates.