Create kubeconfig files
parent
17ddcfbbcd
commit
b1b692b0b2
|
@ -12,15 +12,21 @@ Each kubeconfig requires a Kubernetes API Server to connect to. To support high
|
||||||
|
|
||||||
Retrieve the `kubernetes-the-hard-way` static IP address:
|
Retrieve the `kubernetes-the-hard-way` static IP address:
|
||||||
|
|
||||||
|
```gcloud```
|
||||||
```
|
```
|
||||||
KUBERNETES_PUBLIC_ADDRESS=$(gcloud compute addresses describe kubernetes-the-hard-way \
|
KUBERNETES_PUBLIC_ADDRESS=$(gcloud compute addresses describe kubernetes-the-hard-way \
|
||||||
--region $(gcloud config get-value compute/region) \
|
--region $(gcloud config get-value compute/region) \
|
||||||
--format 'value(address)')
|
--format 'value(address)')
|
||||||
```
|
```
|
||||||
|
|
||||||
|
```az```
|
||||||
|
```
|
||||||
|
KUBERNETES_PUBLIC_ADDRESS=$(az network public-ip show --name kubernetes-the-hard-way --query ipAddress -o tsv)
|
||||||
|
```
|
||||||
|
|
||||||
### The kubelet Kubernetes Configuration File
|
### The kubelet Kubernetes Configuration File
|
||||||
|
|
||||||
When generating kubeconfig files for Kubelets the client certificate matching the Kubelet's node name must be used. This will ensure Kubelets are properly authorized by the Kubernetes [Node Authorizer](https://kubernetes.io/docs/admin/authorization/node/).
|
When generating kubeconfig files for Kubelets the client certificate matching the Kubelet's node name must be used. This will ensure Kubelets are properly authorized by the Kubernetes [Node Authorizer](https://kubernetes.io/docs/reference/access-authn-authz/node/).
|
||||||
|
|
||||||
> The following commands must be run in the same directory used to generate the SSL certificates during the [Generating TLS Certificates](04-certificate-authority.md) lab.
|
> The following commands must be run in the same directory used to generate the SSL certificates during the [Generating TLS Certificates](04-certificate-authority.md) lab.
|
||||||
|
|
||||||
|
@ -62,7 +68,6 @@ worker-2.kubeconfig
|
||||||
Generate a kubeconfig file for the `kube-proxy` service:
|
Generate a kubeconfig file for the `kube-proxy` service:
|
||||||
|
|
||||||
```
|
```
|
||||||
{
|
|
||||||
kubectl config set-cluster kubernetes-the-hard-way \
|
kubectl config set-cluster kubernetes-the-hard-way \
|
||||||
--certificate-authority=ca.pem \
|
--certificate-authority=ca.pem \
|
||||||
--embed-certs=true \
|
--embed-certs=true \
|
||||||
|
@ -81,7 +86,6 @@ Generate a kubeconfig file for the `kube-proxy` service:
|
||||||
--kubeconfig=kube-proxy.kubeconfig
|
--kubeconfig=kube-proxy.kubeconfig
|
||||||
|
|
||||||
kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig
|
kubectl config use-context default --kubeconfig=kube-proxy.kubeconfig
|
||||||
}
|
|
||||||
```
|
```
|
||||||
|
|
||||||
Results:
|
Results:
|
||||||
|
@ -95,7 +99,6 @@ kube-proxy.kubeconfig
|
||||||
Generate a kubeconfig file for the `kube-controller-manager` service:
|
Generate a kubeconfig file for the `kube-controller-manager` service:
|
||||||
|
|
||||||
```
|
```
|
||||||
{
|
|
||||||
kubectl config set-cluster kubernetes-the-hard-way \
|
kubectl config set-cluster kubernetes-the-hard-way \
|
||||||
--certificate-authority=ca.pem \
|
--certificate-authority=ca.pem \
|
||||||
--embed-certs=true \
|
--embed-certs=true \
|
||||||
|
@ -114,7 +117,6 @@ Generate a kubeconfig file for the `kube-controller-manager` service:
|
||||||
--kubeconfig=kube-controller-manager.kubeconfig
|
--kubeconfig=kube-controller-manager.kubeconfig
|
||||||
|
|
||||||
kubectl config use-context default --kubeconfig=kube-controller-manager.kubeconfig
|
kubectl config use-context default --kubeconfig=kube-controller-manager.kubeconfig
|
||||||
}
|
|
||||||
```
|
```
|
||||||
|
|
||||||
Results:
|
Results:
|
||||||
|
@ -129,7 +131,6 @@ kube-controller-manager.kubeconfig
|
||||||
Generate a kubeconfig file for the `kube-scheduler` service:
|
Generate a kubeconfig file for the `kube-scheduler` service:
|
||||||
|
|
||||||
```
|
```
|
||||||
{
|
|
||||||
kubectl config set-cluster kubernetes-the-hard-way \
|
kubectl config set-cluster kubernetes-the-hard-way \
|
||||||
--certificate-authority=ca.pem \
|
--certificate-authority=ca.pem \
|
||||||
--embed-certs=true \
|
--embed-certs=true \
|
||||||
|
@ -148,7 +149,6 @@ Generate a kubeconfig file for the `kube-scheduler` service:
|
||||||
--kubeconfig=kube-scheduler.kubeconfig
|
--kubeconfig=kube-scheduler.kubeconfig
|
||||||
|
|
||||||
kubectl config use-context default --kubeconfig=kube-scheduler.kubeconfig
|
kubectl config use-context default --kubeconfig=kube-scheduler.kubeconfig
|
||||||
}
|
|
||||||
```
|
```
|
||||||
|
|
||||||
Results:
|
Results:
|
||||||
|
@ -162,7 +162,6 @@ kube-scheduler.kubeconfig
|
||||||
Generate a kubeconfig file for the `admin` user:
|
Generate a kubeconfig file for the `admin` user:
|
||||||
|
|
||||||
```
|
```
|
||||||
{
|
|
||||||
kubectl config set-cluster kubernetes-the-hard-way \
|
kubectl config set-cluster kubernetes-the-hard-way \
|
||||||
--certificate-authority=ca.pem \
|
--certificate-authority=ca.pem \
|
||||||
--embed-certs=true \
|
--embed-certs=true \
|
||||||
|
@ -181,7 +180,6 @@ Generate a kubeconfig file for the `admin` user:
|
||||||
--kubeconfig=admin.kubeconfig
|
--kubeconfig=admin.kubeconfig
|
||||||
|
|
||||||
kubectl config use-context default --kubeconfig=admin.kubeconfig
|
kubectl config use-context default --kubeconfig=admin.kubeconfig
|
||||||
}
|
|
||||||
```
|
```
|
||||||
|
|
||||||
Results:
|
Results:
|
||||||
|
@ -197,18 +195,39 @@ admin.kubeconfig
|
||||||
|
|
||||||
Copy the appropriate `kubelet` and `kube-proxy` kubeconfig files to each worker instance:
|
Copy the appropriate `kubelet` and `kube-proxy` kubeconfig files to each worker instance:
|
||||||
|
|
||||||
|
```gcloud```
|
||||||
```
|
```
|
||||||
for instance in worker-0 worker-1 worker-2; do
|
for instance in worker-0 worker-1 worker-2; do
|
||||||
gcloud compute scp ${instance}.kubeconfig kube-proxy.kubeconfig ${instance}:~/
|
gcloud compute scp ${instance}.kubeconfig kube-proxy.kubeconfig ${instance}:~/
|
||||||
done
|
done
|
||||||
```
|
```
|
||||||
|
|
||||||
|
```az```
|
||||||
|
```
|
||||||
|
for instance in worker-0 worker-1 worker-2; do
|
||||||
|
IP=$(az vm show -d --name ${instance} --query "publicIps" -o tsv)
|
||||||
|
scp ${instance}.kubeconfig azureuser@${IP}:/home/azureuser
|
||||||
|
scp kube-proxy.kubeconfig azureuser@${IP}:/home/azureuser
|
||||||
|
done
|
||||||
|
```
|
||||||
|
|
||||||
Copy the appropriate `kube-controller-manager` and `kube-scheduler` kubeconfig files to each controller instance:
|
Copy the appropriate `kube-controller-manager` and `kube-scheduler` kubeconfig files to each controller instance:
|
||||||
|
|
||||||
|
```gcloud```
|
||||||
```
|
```
|
||||||
for instance in controller-0 controller-1 controller-2; do
|
for instance in controller-0 controller-1 controller-2; do
|
||||||
gcloud compute scp admin.kubeconfig kube-controller-manager.kubeconfig kube-scheduler.kubeconfig ${instance}:~/
|
gcloud compute scp admin.kubeconfig kube-controller-manager.kubeconfig kube-scheduler.kubeconfig ${instance}:~/
|
||||||
done
|
done
|
||||||
```
|
```
|
||||||
|
|
||||||
|
```az```
|
||||||
|
```
|
||||||
|
for instance in controller-0 controller-1 controller-2; do
|
||||||
|
IP=$(az vm show -d --name ${instance} --query "publicIps" -o tsv)
|
||||||
|
scp admin.kubeconfig azureuser@${IP}:/home/azureuser
|
||||||
|
scp kube-controller-manager.kubeconfig azureuser@${IP}:/home/azureuser
|
||||||
|
scp kube-scheduler.kubeconfig azureuser@${IP}:/home/azureuser
|
||||||
|
done
|
||||||
|
```
|
||||||
|
|
||||||
Next: [Generating the Data Encryption Config and Key](06-data-encryption-keys.md)
|
Next: [Generating the Data Encryption Config and Key](06-data-encryption-keys.md)
|
||||||
|
|
Loading…
Reference in New Issue