K3s: [Question] Certificate authentication and cert issuing via Certificate API. Have these features been removed?

[zsolt-keseru-epam]

I would like to authenticate users via client certificate, but I've got stuck.
I've tried to find information about setting up user authentication, but only found in the apiserver commandline arguments and the kubeconfig that it uses HTTP basic auth by default.
Is the content of the htpasswd file managed by k3s? If so, how can we add new entries?

I've also tried to issue a new client certificate via the Certifcates API as k3s kubectl api-versions show it's supported. (This is how I tried: https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster and it works on other clusters)
But after approving the CSR with k3s kubectl certificate approve ... the CSR only goes to "Approved" state and not "Approved,Issued", and there is no .status.certificate field.

Without these I've tried to sign my CSR directly using the CA cert, and I wasn't able to authenticate (I'm not sure I've used correct cert files).

Are these the expected behaviors and it's better to forget cert auth to integrate with, or should I report it as bug?
I'm using k3s v0.2.0 (amd64)

[zsolt-keseru-epam]

I've found the server authentication code meanwhile, and as I see it uses the upstream k8s authenticator so I guess certificate authentication should work.
Maybe I've created a wrong client certificate without the Certificate API.

[iluminae]

Does this work? I am using the stable/cockroachdb helm chart on k8s installed via kubeadm, and this system with k3s - only the kubeadm based system issues the approved CSRs.

[huapox]

How's it going?

[huapox]

@zsolt-keseru-epam

[zsolt-keseru-epam]

@huapox I didn't have the chance to investigate this deeper as we decided to move with other solution for a start.
Although now I have checked that certificate issuing is still not working in 0.5.0

[huapox]

I've tested the version 0.7.0-rc2 , it seems works after #359

update: 190728:
bug got this:

kc --kubeconfig=koper.kubeconfig get pod
error: You must be logged in to the server (Unauthorized)

k3s server's log:

server_1    | E0728 19:15:27.324625       8 authentication.go:65] Unable to authenticate the request due to an error: x509: certificate signed by unknown authority

[huapox]

Tested Okay, via #684

[brandond]

Closing due to age.