kubernetes-the-hard-way/docs/03-auth-configs.md

141 lines
3.7 KiB
Markdown
Raw Normal View History

2017-03-24 09:08:54 +03:00
# Setting up Authentication
2017-03-24 14:08:34 +03:00
In this lab you will setup the necessary authentication configs to enable Kubernetes clients to bootstrap and authenticate using RBAC (Role-Based Access Control).
## Download and Install kubectl
The kubectl client will be used to generate kubeconfig files which will be consumed by the kubelet and kube-proxy services.
### OS X
2017-03-24 09:08:54 +03:00
```
2017-04-12 17:09:55 +03:00
wget https://storage.googleapis.com/kubernetes-release/release/v1.6.1/bin/darwin/amd64/kubectl
2017-03-24 14:08:34 +03:00
chmod +x kubectl
sudo mv kubectl /usr/local/bin
```
### Linux
```
2017-04-12 17:09:55 +03:00
wget https://storage.googleapis.com/kubernetes-release/release/v1.6.1/bin/linux/amd64/kubectl
2017-03-24 14:08:34 +03:00
chmod +x kubectl
sudo mv kubectl /usr/local/bin
2017-03-24 09:08:54 +03:00
```
## Authentication
2017-04-14 19:06:58 +03:00
The following components will leverage Kubernetes RBAC:
2017-03-24 14:08:34 +03:00
2017-03-24 09:08:54 +03:00
* kubelet (client)
2017-03-25 19:58:47 +03:00
* kube-proxy (client)
* kubectl (client)
2017-03-24 09:08:54 +03:00
The other components, mainly the `scheduler` and `controller manager`, access the Kubernetes API server locally over the insecure API port which does not require authentication. The insecure port is only enabled for local access.
2017-03-25 19:58:47 +03:00
### Create the TLS Bootstrap Token
2017-03-24 14:08:34 +03:00
This section will walk you through the creation of a TLS bootstrap token that will be used to [bootstrap TLS client certificates for kubelets](https://kubernetes.io/docs/admin/kubelet-tls-bootstrapping/).
2017-03-24 14:08:34 +03:00
2017-03-24 09:08:54 +03:00
Generate a token:
```
2017-03-24 09:08:54 +03:00
BOOTSTRAP_TOKEN=$(head -c 16 /dev/urandom | od -An -t x | tr -d ' ')
```
2017-03-24 09:08:54 +03:00
Generate a token file:
```
cat > token.csv <<EOF
${BOOTSTRAP_TOKEN},kubelet-bootstrap,10001,"system:kubelet-bootstrap"
EOF
```
2017-03-25 19:58:47 +03:00
Distribute the bootstrap token file to each controller node:
2017-03-24 09:08:54 +03:00
```
for host in controller0 controller1 controller2; do
gcloud compute scp token.csv ${host}:~/
2017-03-24 09:08:54 +03:00
done
```
2017-03-25 19:58:47 +03:00
## Client Authentication Configs
2017-03-24 09:08:54 +03:00
2017-03-24 14:08:34 +03:00
This section will walk you through creating kubeconfig files that will be used to bootstrap kubelets, which will then generate their own kubeconfigs based on dynamically generated certificates, and a kubeconfig for authenticating kube-proxy clients.
Each kubeconfig requires a Kubernetes master to connect to. To support H/A the IP address assigned to the load balancer sitting in front of the Kubernetes API servers will be used.
2017-03-25 19:58:47 +03:00
### Set the Kubernetes Public Address
2017-03-24 14:08:34 +03:00
```
2017-03-25 19:58:47 +03:00
KUBERNETES_PUBLIC_ADDRESS=$(gcloud compute addresses describe kubernetes-the-hard-way \
2017-03-24 14:08:34 +03:00
--region us-central1 \
--format 'value(address)')
```
2017-03-25 19:58:47 +03:00
## Create client kubeconfig files
### Create the bootstrap kubeconfig file
2017-03-24 09:08:54 +03:00
```
kubectl config set-cluster kubernetes-the-hard-way \
--certificate-authority=ca.pem \
--embed-certs=true \
--server=https://${KUBERNETES_PUBLIC_ADDRESS}:6443 \
--kubeconfig=bootstrap.kubeconfig
```
```
kubectl config set-credentials kubelet-bootstrap \
--token=${BOOTSTRAP_TOKEN} \
--kubeconfig=bootstrap.kubeconfig
```
```
kubectl config set-context default \
--cluster=kubernetes-the-hard-way \
--user=kubelet-bootstrap \
--kubeconfig=bootstrap.kubeconfig
```
```
kubectl config use-context default --kubeconfig=bootstrap.kubeconfig
```
2017-03-25 19:58:47 +03:00
### Create the kube-proxy kubeconfig
2017-03-24 09:08:54 +03:00
2017-03-24 14:08:34 +03:00
2017-03-24 09:08:54 +03:00
```
kubectl config set-cluster kubernetes-the-hard-way \
--certificate-authority=ca.pem \
--embed-certs=true \
--server=https://${KUBERNETES_PUBLIC_ADDRESS}:6443 \
--kubeconfig=kube-proxy.kubeconfig
```
```
kubectl config set-credentials kube-proxy \
--client-certificate=kube-proxy.pem \
--client-key=kube-proxy-key.pem \
--embed-certs=true \
--kubeconfig=kube-proxy.kubeconfig
```
```
kubectl config set-context default \
--cluster=kubernetes-the-hard-way \
--user=kube-proxy \
--kubeconfig=kube-proxy.kubeconfig
```
```
kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig
```
2017-03-25 19:58:47 +03:00
## Distribute the client kubeconfig files
2017-03-24 09:08:54 +03:00
```
for host in worker0 worker1 worker2; do
gcloud compute scp bootstrap.kubeconfig kube-proxy.kubeconfig ${host}:~/
2017-03-24 09:08:54 +03:00
done
```