In a Certificate signing request API object for a user, you have to specify a group.
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
name: myname
spec:
groups:
- system:authenticated
request: someCertFile
usages:
- digital signature
- key encipherment
- server auth
I know some of the certificates in the cluster, like the kubelets for example, have to use this group in order to differentiate their roles in the cluster. I believe the one for kubelet is nodes:nodename or something like that.
But what does this actually signify from a user standpoint? The only thing I've found on this subject is a brief mention on the k8s docs: https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/#kubernetes-signers