$ openssl genrsa -out lyarwood.pem
$ openssl req -new -key lyarwood.pem -out lyarwood.csr -subj "/CN=lyarwood"

$ ./cluster-up/kubectl.sh apply -f - <<EOF
---
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: user-request-lyarwood
spec:
  groups:
  - system:authenticated
  request:  $(cat lyarwood.csr | base64 | tr -d '\n')
  signerName: kubernetes.io/kube-apiserver-client
  expirationSeconds: 315569260
  usages:
  - digital signature
  - key encipherment
  - client auth
EOF
certificatesigningrequest.certificates.k8s.io/user-request-lyarwood created

$ ./cluster-up/kubectl.sh certificate approve user-request-lyarwood
$ ./cluster-up/kubectl.sh get csr user-request-lyarwood -o jsonpath='{.status.certificate}' | base64 -d > lyarwood-user.crt

$ cp $(./cluster-up/kubeconfig.sh) ./.lyarwood-config
$ ./cluster-up/kubectl.sh config --kubeconfig ./.lyarwood-config set-credentials lyarwood --client-certificate=lyarwood-user.crt --client-key=lyarwood.pem --embed-certs=true
$ ./cluster-up/kubectl.sh config --kubeconfig ./.lyarwood-config set-context lyarwood@kubernetes --cluster=kubernetes --user=lyarwood

$ ./cluster-up/kubectl.sh --kubeconfig ./.lyarwood-config apply -f - <<EOF
> apiVersion: v1
kind: Namespace
metadata:
  name: lyarwood
spec: {}
status: {}
---
kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: lyarwood
  namespace: lyarwood
subjects:
- kind: User
  name: lyarwood
  apiGroup: rbac.authorization.k8s.io
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: view
EOF

$ ./cluster-up/kubectl.sh --kubeconfig ./.lyarwood-config config use-context lyarwood@kubernetes
$ ./cluster-up/kubectl.sh --kubeconfig ./.lyarwood-config get virtualmachineclusterinstancetypes
selecting podman as container runtime
Error from server (Forbidden): virtualmachineclusterinstancetypes.instancetype.kubevirt.io is forbidden: User "lyarwood" cannot list resource "virtualmachineclusterinstancetypes" in API group "instancetype.kubevirt.io" at the cluster scope

$ ./cluster-up/kubectl.sh --kubeconfig ./.lyarwood-config config use-context kubernetes-admin@kubernetes
selecting podman as container runtime
Switched to context "kubernetes-admin@kubernetes".
$ ./cluster-up/kubectl.sh --kubeconfig ./.lyarwood-config apply -f - << EOF
> kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: lyarwood-instancetype-view
subjects:
- kind: User
  name: lyarwood
  apiGroup: rbac.authorization.k8s.io
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: instancetype.kubevirt.io:view
EOF
selecting podman as container runtime
clusterrolebinding.rbac.authorization.k8s.io/lyarwood-instancetype-view created

$ ./cluster-up/kubectl.sh --kubeconfig ./.lyarwood-config config use-context lyarwood@kubernetes
$ ./cluster-up/kubectl.sh --kubeconfig ./.lyarwood-config get virtualmachineclusterinstancetypes
selecting podman as container runtime
No resources found