Skip to content

Commit c5bf6b3

Browse files
manzil-infinity180manzil-infinity180
committed
merge conflict
2 parents 5a86c37 + d380e0b commit c5bf6b3

File tree

2 files changed

+249
-1
lines changed

2 files changed

+249
-1
lines changed

‎Kubeconfig.md

Lines changed: 248 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,248 @@
1+
## Kubeconfig
2+
3+
kubectl uses one file which is kubeconfig to authenticate itself
4+
5+
if client want then it need private key and client certificate
6+
7+
## How to access the kubeconfig file on our machine
8+
9+
```go
10+
rahulxf@Rahuls-MacBook-Air-3 ~ % cd $HOME/.kube/  <---
11+
12+
rahulxf@Rahuls-MacBook-Air-3 .kube % ls -l
13+
total 160
14+
drwxr-x---@ 4 rahulxf  staff    128 Jan 17 22:46 cache
15+
-rw-------@ 1 rahulxf  staff  31948 Feb 17 10:48 config <--- kubeconfig file
16+
-rw-r--r--  1 rahulxf  staff   7973 Feb  4 16:01 karmada-apiserver.config
17+
-rw-------  1 rahulxf  staff  13415 Feb 11 19:28 karmada.config
18+
-rw-r--r--  1 rahulxf  staff      4 Feb 17 10:43 kubectx
19+
drwxr-xr-x  4 rahulxf  staff    128 Feb 17 10:48 kubens
20+
-rw-r--r--  1 rahulxf  staff  16652 Feb  2 22:01 members.config
21+
```
22+
23+
Create kind cluster
24+
----
25+
```rs
26+
$ kind create cluster
27+
```
28+
* config is the kubeconfig file
29+
30+
```rs
31+
apiVersion: v1
32+
clusters:
33+
- cluster:
34+
certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURQRENDQWlTZ0F3SUJBZ0lDQm5Zd0RRWUpLb1pJa......
35+
server: https://cp1.localtest.me:9443
36+
37+
name: cp1-cluster
38+
- cluster:
39+
server: ""
40+
41+
name: its1
42+
- cluster:
43+
certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJlRENDQVIyZ0F3SUJBZ0lCQURBS0JnZ3Foa2pPU....
44+
server: https://its1.localtest.me:9443
45+
name: its1-cluster
46+
47+
contexts:
48+
- context:
49+
cluster: kind-cluster1
50+
user: kind-cluster1
51+
name: cluster1
52+
53+
- context:
54+
cluster: kind-cluster2
55+
user: kind-cluster2
56+
name: cluster2
57+
58+
users:
59+
- name: cp1-admin
60+
user:
61+
client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURSVENDQWkyZ0F3SUJBZ0lDQm5vd0RRWUpLb1pJaHZjTkFRRUxCUUF3UHpFVE1CRUdBMVVFQ2hNS1MzVmkKWlhKdVpYUmxjekVUTUJFR0ExVUVDeE1LUVZCSklGTmxjblpsY2pFVE1CRUdBMVVFQXhNS2EzVmlaWEp1WlhSbApjekFlRncweU5UQXhNVGN4TmpJek5UUmFGdzB6TlRB
62+
63+
client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFcGdJQkFBS0NBUUVBM1l0MmgzVHp6NHgzYnU2akhJWXVDZHVKbWpTejNrSWtYVFczNEFHN2ZtR2hENS9DCjZNOFdtZGd1clFjU0doQVIyOENSaUhKUHoxckU4
64+
65+
- name: its1-admin
66+
67+
user:
68+
69+
client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJrRENDQVRlZ0F3SUJBZ0lJVmloSTBuYzg0dDR3Q2dZS
70+
71+
client-key-data: LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tNNDkKQXdFSG9VUURRZ0FFa1ZXYWNmbmwyTlg0L1d6NCthVS9JVzVyU05lSVhGZW5ROT
72+
73+
- name: kind-cluster1
74+
75+
user:
76+
client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURLVENDQWhHZ0F3SUJBZ0lJR0ZhWGh1RFU4c2t3RFFZSktvWklW9
77+
78+
client-key-data: LS0tLS
79+
```
80+
81+
Flow diagram
82+
----
83+
84+
<img width="929" alt="shapes at 25-02-20 12 40 47" src="https://github.com/user-attachments/assets/fee09087-1fce-4324-bf42-44f01e0464ad" />
85+
86+
87+
How to add users
88+
----
89+
90+
```
91+
$ kubectl config set-credentials devuser --client-certificate du.crt --client-key du.key
92+
93+
User "devuser" set.
94+
```
95+
96+
You also need to map it , i mean you need to add context for this user for the cluster
97+
---
98+
99+
```
100+
$ kubectl config set-context --cluster kind-kind --user devuser
101+
102+
Context "devuser-kind" created
103+
```
104+
105+
```
106+
- context:
107+
cluster: kind-kind
108+
user: devuser
109+
name: devuser-kind
110+
```
111+
112+
If you want to check which context we are using
113+
---
114+
115+
`$ kubectl config current-context`
116+
117+
or
118+
you can install `kubectx`
119+
120+
* Flow of kubectl for looking kubeconfig file
121+
1) --kubeconfig flag to kubectl command
122+
2) Then it will look for the environmental variable (env)
123+
3) after in the last it will look for the $HOME/.kube/config file
124+
125+
Suppose you want - 2,3 kubeconfig file as one file then you can do this like you can specify the kubeconfig file with colon(:) separated
126+
127+
```
128+
$ export KUBECONFIG=~/.kube/config:~/.kube/karmada.config:~/.kube/karmada-apiserver.config
129+
```
130+
131+
<img width="1120" alt="Screenshot 2025-02-18 at 11 21 48 PM" src="https://github.com/user-attachments/assets/d1d742bf-d308-42a8-bcf6-41b4d5c881da" />
132+
133+
To authenticate the user to Kubernetes cluster we will do client certificate management
134+
---
135+
136+
docker ps (get the id )
137+
docker exec -it <id> bash
138+
cd /etc/kubernetes/pki
139+
ls -l (you will see the key, csr and other files )
140+
141+
142+
* So for creating private key and csr key you can run this command to generate
143+
144+
<img width="1199" alt="shapes at 25-02-20 12 39 00" src="https://github.com/user-attachments/assets/99159373-2e30-4568-85a3-d36f1536d9a9" />
145+
146+
Generate new ssl key:
147+
-----
148+
149+
```
150+
$ openssl genrsa -out rahulxf.key 2048
151+
```
152+
153+
Generate new certificate signing request for the issuer authority:
154+
----
155+
156+
```
157+
#CN is the name of the user
158+
#O is the group name. When you will create the rolebinding do the binding based on group name.
159+
$ openssl req -new -key rahulxf.key -out rahulxf.csr -subj "/CN=rahulxf/0=developers"
160+
```
161+
162+
<img width="1157" alt="Screenshot 2025-02-19 at 12 46 29 AM" src="https://github.com/user-attachments/assets/c3cf391d-1a0a-4c4d-867f-da607225247f" />
163+
164+
<img width="986" alt="Screenshot 2025-02-19 at 12 56 19 AM" src="https://github.com/user-attachments/assets/850c5a52-7c21-44b0-89cc-1ce229dca0cd" />
165+
166+
The next step is to creating the user and setting up the context between the user and cluster in kubeconfig file
167+
------
168+
169+
```
170+
# Adding user
171+
$ kubectl config set-credentials rahulxf --client-certificate rahulxf.crt --client-key rahulxf.key
172+
173+
# Creating context for the user and cluster
174+
$ kubectl config set-context rahulxf-kind --user rahulxf --cluster kind-cluster2
175+
176+
```
177+
<img width="937" alt="Screenshot 2025-02-20 at 12 17 04 AM" src="https://github.com/user-attachments/assets/6b653c3b-49e8-48f4-add9-9859023d9fe8" />
178+
179+
* Here you can look for the kubeconfig file
180+
181+
<img width="1499" alt="Screenshot 2025-02-19 at 1 09 37 AM" src="https://github.com/user-attachments/assets/367eda1b-0ae6-4604-a2e7-62793769e42a" />
182+
183+
* see your context using command
184+
185+
```
186+
$ kubectl config current-context
187+
$ kubectl config get-contexts
188+
$ kubectl config use-context <context_name>
189+
190+
# OR use kubectx
191+
$ kubectx
192+
```
193+
<img width="1094" alt="Screenshot 2025-02-19 at 1 10 23 AM" src="https://github.com/user-attachments/assets/093537f4-76b7-4f11-890e-77781eefa5cd" />
194+
195+
196+
* allow namespaces
197+
<img width="1310" alt="Screenshot 2025-02-19 at 1 17 41 AM" src="https://github.com/user-attachments/assets/b9e2ca7c-ac1c-4b7c-9384-4ec96a951f15" />
198+
199+
200+
* allow pods
201+
<img width="1310" alt="Screenshot 2025-02-19 at 1 23 04 AM" src="https://github.com/user-attachments/assets/9967a9df-bac0-42d9-9b3a-d177e764b2b5" />
202+
203+
Certificate Singning Request
204+
----
205+
* Creating the certificate singning request with the k8s ca.crt key
206+
<img width="1337" alt="Screenshot 2025-02-19 at 1 31 19 AM" src="https://github.com/user-attachments/assets/2b8a8983-e7b8-4731-861c-4664d129f649" />
207+
208+
* To put into our csr yaml file we need to encode the key
209+
<img width="1337" alt="Screenshot 2025-02-19 at 1 34 14 AM" src="https://github.com/user-attachments/assets/d602c7c0-b2d1-421e-b8ee-962f2742e046" />
210+
211+
```yaml
212+
// csr.yaml
213+
apiVersion: certificates.k8s.io/v1
214+
kind: CertificateSigningRequest
215+
metadata:
216+
name: rahulxf
217+
spec:
218+
groups:
219+
- developers
220+
request: |
221+
LS0tLS1CRUdJTiBDRVJUSUZJQ0FURSBSRVFVRVNULS....
222+
signerName: kubernetes.io/kube-apiserver-client
223+
usages:
224+
- client auth
225+
```
226+
227+
And then create it using kubectl command
228+
229+
```bash
230+
$ kubectl create -f csr. yaml
231+
certificatesigningrequest.certificates.k8s.io/rahulxf_created
232+
233+
# Get your certificate
234+
$ kubectl get csr
235+
236+
# Approve your certificate
237+
# rahulxf == name
238+
$ kubectl certificate approve rahulxf
239+
240+
# Look for the certificate details
241+
$ kubectl describe csr rahulxf
242+
```
243+
244+
<img width="1337" alt="Screenshot 2025-02-19 at 1 44 04 AM" src="https://github.com/user-attachments/assets/477297d6-ac7a-4db7-8b0e-f26b586b9620" />
245+
246+
<img width="1231" alt="Screenshot 2025-02-20 at 12 35 04 PM" src="https://github.com/user-attachments/assets/87e933b6-de22-44ef-9d32-3b1ad54b9f7b" />
247+
248+

‎user-creating-k8s-command.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ kubectl auth can-i list pods -n dev
105105
```
106106

107107

108-
Reference
108+
Reference
109109
---
110110

111111
-> https://github.com/asimehsan/devops-vu/blob/main/Install%20k8s%20locally/RBAC%20User%20.txt \

0 commit comments

Comments
 (0)