2017-08-29 00:19:25 +03:00
# Generating Kubernetes Configuration Files for Authentication
In this lab you will generate [Kubernetes configuration files ](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/ ), also known as kubeconfigs, which enable Kubernetes clients to locate and authenticate to the Kubernetes API Servers.
## Client Authentication Configs
2023-11-01 09:16:49 +03:00
In this section you will generate kubeconfig files for the `kubelet` and the `admin` user.
2017-08-29 00:19:25 +03:00
### The kubelet Kubernetes Configuration File
When generating kubeconfig files for Kubelets the client certificate matching the Kubelet's node name must be used. This will ensure Kubelets are properly authorized by the Kubernetes [Node Authorizer ](https://kubernetes.io/docs/admin/authorization/node/ ).
2019-09-14 21:41:56 +03:00
> The following commands must be run in the same directory used to generate the SSL certificates during the [Generating TLS Certificates](04-certificate-authority.md) lab.
2024-11-03 17:46:21 +03:00
Generate a kubeconfig file for the node-0 worker node:
2017-08-29 00:19:25 +03:00
2023-11-01 09:16:49 +03:00
```bash
for host in node-0 node-1; do
2017-08-29 00:19:25 +03:00
kubectl config set-cluster kubernetes-the-hard-way \
2023-11-01 09:16:49 +03:00
--certificate-authority=ca.crt \
2017-08-29 00:19:25 +03:00
--embed-certs=true \
2023-11-01 09:16:49 +03:00
--server=https://server.kubernetes.local:6443 \
--kubeconfig=${host}.kubeconfig
2017-08-29 00:19:25 +03:00
2023-11-01 09:16:49 +03:00
kubectl config set-credentials system:node:${host} \
--client-certificate=${host}.crt \
--client-key=${host}.key \
2017-08-29 00:19:25 +03:00
--embed-certs=true \
2023-11-01 09:16:49 +03:00
--kubeconfig=${host}.kubeconfig
2017-08-29 00:19:25 +03:00
kubectl config set-context default \
--cluster=kubernetes-the-hard-way \
2023-11-01 09:16:49 +03:00
--user=system:node:${host} \
--kubeconfig=${host}.kubeconfig
2017-08-29 00:19:25 +03:00
2023-11-01 09:16:49 +03:00
kubectl config use-context default \
--kubeconfig=${host}.kubeconfig
2017-08-29 00:19:25 +03:00
done
```
Results:
2023-11-01 09:16:49 +03:00
```text
node-0.kubeconfig
node-1.kubeconfig
2017-08-29 00:19:25 +03:00
```
### The kube-proxy Kubernetes Configuration File
Generate a kubeconfig file for the `kube-proxy` service:
2023-11-01 09:16:49 +03:00
```bash
2018-05-12 19:54:18 +03:00
{
kubectl config set-cluster kubernetes-the-hard-way \
2023-11-01 09:16:49 +03:00
--certificate-authority=ca.crt \
2018-05-12 19:54:18 +03:00
--embed-certs=true \
2023-11-01 09:16:49 +03:00
--server=https://server.kubernetes.local:6443 \
2018-05-12 19:54:18 +03:00
--kubeconfig=kube-proxy.kubeconfig
kubectl config set-credentials system:kube-proxy \
2023-11-01 09:16:49 +03:00
--client-certificate=kube-proxy.crt \
--client-key=kube-proxy.key \
2018-05-12 19:54:18 +03:00
--embed-certs=true \
--kubeconfig=kube-proxy.kubeconfig
kubectl config set-context default \
--cluster=kubernetes-the-hard-way \
--user=system:kube-proxy \
--kubeconfig=kube-proxy.kubeconfig
2023-11-01 09:16:49 +03:00
kubectl config use-context default \
--kubeconfig=kube-proxy.kubeconfig
2018-05-12 19:54:18 +03:00
}
```
Results:
2023-11-01 09:16:49 +03:00
```text
2018-05-12 19:54:18 +03:00
kube-proxy.kubeconfig
```
### The kube-controller-manager Kubernetes Configuration File
Generate a kubeconfig file for the `kube-controller-manager` service:
2023-11-01 09:16:49 +03:00
```bash
2018-05-12 19:54:18 +03:00
{
kubectl config set-cluster kubernetes-the-hard-way \
2023-11-01 09:16:49 +03:00
--certificate-authority=ca.crt \
2018-05-12 19:54:18 +03:00
--embed-certs=true \
2023-11-01 09:16:49 +03:00
--server=https://server.kubernetes.local:6443 \
2018-05-12 19:54:18 +03:00
--kubeconfig=kube-controller-manager.kubeconfig
kubectl config set-credentials system:kube-controller-manager \
2023-11-01 09:16:49 +03:00
--client-certificate=kube-controller-manager.crt \
--client-key=kube-controller-manager.key \
2018-05-12 19:54:18 +03:00
--embed-certs=true \
--kubeconfig=kube-controller-manager.kubeconfig
kubectl config set-context default \
--cluster=kubernetes-the-hard-way \
--user=system:kube-controller-manager \
--kubeconfig=kube-controller-manager.kubeconfig
2023-11-01 09:16:49 +03:00
kubectl config use-context default \
--kubeconfig=kube-controller-manager.kubeconfig
2018-05-12 19:54:18 +03:00
}
```
Results:
2023-11-01 09:16:49 +03:00
```text
2018-05-12 19:54:18 +03:00
kube-controller-manager.kubeconfig
```
### The kube-scheduler Kubernetes Configuration File
Generate a kubeconfig file for the `kube-scheduler` service:
2023-11-01 09:16:49 +03:00
```bash
2018-05-12 19:54:18 +03:00
{
kubectl config set-cluster kubernetes-the-hard-way \
2023-11-01 09:16:49 +03:00
--certificate-authority=ca.crt \
2018-05-12 19:54:18 +03:00
--embed-certs=true \
2023-11-01 09:16:49 +03:00
--server=https://server.kubernetes.local:6443 \
2018-05-12 19:54:18 +03:00
--kubeconfig=kube-scheduler.kubeconfig
kubectl config set-credentials system:kube-scheduler \
2023-11-01 09:16:49 +03:00
--client-certificate=kube-scheduler.crt \
--client-key=kube-scheduler.key \
2018-05-12 19:54:18 +03:00
--embed-certs=true \
--kubeconfig=kube-scheduler.kubeconfig
kubectl config set-context default \
--cluster=kubernetes-the-hard-way \
--user=system:kube-scheduler \
--kubeconfig=kube-scheduler.kubeconfig
2023-11-01 09:16:49 +03:00
kubectl config use-context default \
--kubeconfig=kube-scheduler.kubeconfig
2018-05-12 19:54:18 +03:00
}
2017-08-29 00:19:25 +03:00
```
2018-05-12 19:54:18 +03:00
Results:
2023-11-01 09:16:49 +03:00
```text
2018-05-12 19:54:18 +03:00
kube-scheduler.kubeconfig
2017-08-29 00:19:25 +03:00
```
2018-05-12 19:54:18 +03:00
### The admin Kubernetes Configuration File
Generate a kubeconfig file for the `admin` user:
2023-11-01 09:16:49 +03:00
```bash
2018-05-12 19:54:18 +03:00
{
kubectl config set-cluster kubernetes-the-hard-way \
2023-11-01 09:16:49 +03:00
--certificate-authority=ca.crt \
2018-05-12 19:54:18 +03:00
--embed-certs=true \
--server=https://127.0.0.1:6443 \
--kubeconfig=admin.kubeconfig
kubectl config set-credentials admin \
2023-11-01 09:16:49 +03:00
--client-certificate=admin.crt \
--client-key=admin.key \
2018-05-12 19:54:18 +03:00
--embed-certs=true \
--kubeconfig=admin.kubeconfig
kubectl config set-context default \
--cluster=kubernetes-the-hard-way \
--user=admin \
--kubeconfig=admin.kubeconfig
2023-11-01 09:16:49 +03:00
kubectl config use-context default \
--kubeconfig=admin.kubeconfig
2018-05-12 19:54:18 +03:00
}
2017-08-29 00:19:25 +03:00
```
2018-05-12 19:54:18 +03:00
Results:
2023-11-01 09:16:49 +03:00
```text
2018-05-12 19:54:18 +03:00
admin.kubeconfig
2017-08-29 00:19:25 +03:00
```
## Distribute the Kubernetes Configuration Files
2023-11-01 09:16:49 +03:00
Copy the `kubelet` and `kube-proxy` kubeconfig files to the node-0 instance:
```bash
for host in node-0 node-1; do
ssh root@$host "mkdir /var/lib/{kube-proxy,kubelet}"
scp kube-proxy.kubeconfig \
root@$host:/var/lib/kube-proxy/kubeconfig \
scp ${host}.kubeconfig \
root@$host:/var/lib/kubelet/kubeconfig
2017-08-29 00:19:25 +03:00
done
```
2023-11-01 09:16:49 +03:00
Copy the `kube-controller-manager` and `kube-scheduler` kubeconfig files to the controller instance:
2018-05-12 19:54:18 +03:00
2023-11-01 09:16:49 +03:00
```bash
scp admin.kubeconfig \
kube-controller-manager.kubeconfig \
kube-scheduler.kubeconfig \
root@server:~/
2018-05-12 19:54:18 +03:00
```
2017-08-29 00:19:25 +03:00
Next: [Generating the Data Encryption Config and Key ](06-data-encryption-keys.md )