Kubeconfig示例及解析
What is a Kubeconfig file?
A Kubeconfig is a YAML file with all the Kubernetes cluster details, certificate, and secret token to authenticate the cluster. You might get this config file directly from the cluster administrator or from a cloud platform if you are using managed Kubernetes cluster.
Example Kubeconfig File
Here is an example of a Kubeconfig. It needs the following key information to connect to the Kubernetes clusters.
- certificate-authority-data: Cluster CA
- server: Cluster endpoint (IP/DNS of master node)
- name: Cluster name
- user: name of the user/service account.
- token: Secret token of the user/service account.
1apiVersion: v1
2clusters:
3- cluster:
4 certificate-authority-data: <ca-data-here>
5 server: https://your-k8s-cluster.com
6 name: <cluster-name>
7contexts:
8- context:
9 cluster: <cluster-name>
10 user: <cluster-name-user>
11 name: <cluster-name>
12current-context: <cluster-name>
13kind: Config
14preferences: {}
15users:
16- name: <cluster-name-user>
17 user:
18 token: <secret-token-here>
19</secret-token-here></cluster-name-user></cluster-name></cluster-name></cluster-name-user></cluster-name></cluster-name></ca-data-here>
Different Methods to Connect Kubernetes Cluster With Kubeconfig File
You can use the Kubeconfig in different ways and each way has its own precedence. Here is the precedence in order,.
- Kubectl Context: Kubeconfig with kubectl overrides all other configs. It has the highest precedence.
- Environment Variable: KUBECONFIG env variable overrides current context.
- Command-Line Reference: The current context has the least precedence over inline config reference and env variable.
Now let’s take a look at all the three ways to use the Kubeconfig file.
Method 1: Connect to Kubernetes Cluster With Kubeconfig Kubectl Context
To connect to the Kubernetes cluster, the basic prerequisite is the Kubectl CLI plugin. If you dont have the CLI installed, follow the instructions given here.
Now follow the steps given below to use the kubeconfig file to interact with the cluster.
Step 1: Move kubeconfig to .kube directory.
Kubectl interacts with the kubernetes cluster using the details available in the Kubeconfig file. By default, kubectl looks for the config file in the /.kube
location.
Lets move the kubeconfig file to the .kube directory. Replace /path/to/kubeconfig
with your kubeconfig current path.
1mv /path/to/kubeconfig ~/.kube
Step 2: List all cluster contexts
You can have any number of kubeconfig in the .kube
directory. Each config will have a unique context name (ie, the name of the cluster). You can validate the Kubeconfig file by listing the contexts. You can list all the contexts using the following command. It will list the context name as the name of the cluster.
1kubectl config get-contexts
Step 3: Set the current context
Now you need to set the current context to your kubeconfig file. You can set that using the following command. replace <cluster-name>
with your listed context name.
1kubectl config use-context <cluster-name>
2</cluster-name>
For example,
1kubectl config use-context my-dev-cluster
Step 4: Validate the Kubernetes cluster connectivity
To validate the cluster connectivity, you can execute the following kubectl command to list the cluster nodes.
1kubectl get nodes
Method 2: Connect with KUBECONFIG environment variable
You can set the KUBECONFIG
environment variable with the kubeconfig
file path to connect to the cluster. So wherever you are using the kubectl command from the terminal, the KUBECONFIG
env variable should be available. If you set this variable, it overrides the current cluster context.
You can set the variable using the following command. Where dev_cluster_config
is the kubeconfig
file name.
1KUBECONFIG=$HOME/.kube/dev_cluster_config
Method 3: Using Kubeconfig File With Kubectl
You can pass the Kubeconfig file with the Kubectl command to override the current context and KUBECONFIG env variable.
Here is an example to get nodes.
1kubectl get nodes --kubeconfig=$HOME/.kube/dev_cluster_config
Also you can use,
1KUBECONFIG=$HOME/.kube/dev_cluster_config kubectl get nodes
Merging Multiple Kubeconfig Files
Usually, when you work with Kubernetes services like GKE, all the cluster contexts get added as a single file. However, there are situations where you will be given a Kubeconfig file with limited access to connect to prod or non-prod servers. To manage all clusters effectively using a single config, you can merge the other Kubeconfig files to the default $HOME/.kube/config
file using the supported kubectl command.
Lets assume you have three Kubeconfig files in the $HOME/.kube/
directory.
- config (default kubeconfig)
- dev_config
- test_config
You can merge all the three configs into a single file using the following command. Ensure you are running the command from the $HOME/.kub
e directory
1KUBECONFIG=config:dev_config:test_config kubectl config view --merge --flatten > config.new
The above command creates a merged config named config.new
.
Now rename the old **$HOME.kube/config**
file.
1 mv $HOME/.kube/config $HOME/.kube/config.old
Rename the config.new
to config.
1mv $HOME/.kube/config.new $HOME/.kube/config
To verify the configuration, try listing the contexts from the config.
1kubectl config get-contexts
How to Generate Kubeconfig File?
A kubeconfig needs the following important details.
- Cluster endpoint (IP or DNS name of the cluster)
- Cluster CA Certificate
- Cluster name
- Service account user name
- Service account token
Note: To generate a Kubeconfig file, you need to have admin permissions in the cluster to create service accounts and roles.
For this demo, I am creating a service account with clusterRole
that has limited access to the cluster-wide resources. You can also create a normal role and Rolebinding
that limits the user access to a specific namespace.
Step 1: Create a Service Account
The service account name will be the user name in the Kubeconfig. Here I am creating the service account in the kube-system
as I am creating a clusterRole. If you want to create a config to give namespace level limited access, create the service account in the required namespace.
1kubectl -n kube-system create serviceaccount devops-cluster-admin
Step 2: Create a ClusterRole
Let’s create a clusterRole
with limited privileges to cluster objects. You can add the required object access as per your requirements. Refer to the service account with clusterRole access blog for more information.
If you want to create a namespace scoped role, refer to creating service account with role.
Execute the following command to create the clusterRole.
1cat
Step 3: Create ClusterRoleBinding
The following YAML is a ClusterRoleBinding that binds the devops-cluster-admin
service account with the devops-cluster-admin
clusterRole.
1cat
Step 4: Get all Cluster Details & Secrets
We will retrieve all the required kubeconfig details and save them in variables. Then, finally, we will substitute it directly to the Kubeconfig YAML.
1export SA_TOKEN_NAME=$(kubectl -n kube-system get serviceaccount devops-cluster-admin -o=jsonpath='{.secrets[0].name}')
2
3export SA_SECRET_TOKEN=$(kubectl -n kube-system get secret/${SA_TOKEN_NAME} -o=go-template='{{.data.token}}' | base64 --decode)
4
5export CLUSTER_NAME=$(kubectl config current-context)
6
7export CURRENT_CLUSTER=$(kubectl config view --raw -o=go-template='{{range .contexts}}{{if eq .name "'''${CLUSTER_NAME}'''"}}{{ index .context "cluster" }}{{end}}{{end}}')
8
9export CLUSTER_CA_CERT=$(kubectl config view --raw -o=go-template='{{range .clusters}}{{if eq .name "'''${CURRENT_CLUSTER}'''"}}"{{with index .cluster "certificate-authority-data" }}{{.}}{{end}}"{{ end }}{{ end }}')
10
11export CLUSTER_ENDPOINT=$(kubectl config view --raw -o=go-template='{{range .clusters}}{{if eq .name "'''${CURRENT_CLUSTER}'''"}}{{ .cluster.server }}{{end}}{{ end }}')
Step 5: Generate the Kubeconfig With the variables.
If you execute the following YAML, all the variables get substituted and a config named devops-cluster-admin-config
gets generated.
1cat devops-cluster-admin-config
2apiVersion: v1
3kind: Config
4current-context: ${CLUSTER_NAME}
5contexts:
6- name: ${CLUSTER_NAME}
7 context:
8 cluster: ${CLUSTER_NAME}
9 user: devops-cluster-admin
10clusters:
11- name: ${CLUSTER_NAME}
12 cluster:
13 certificate-authority-data: ${CLUSTER_CA_CERT}
14 server: ${CLUSTER_ENDPOINT}
15users:
16- name: devops-cluster-admin
17 user:
18 token: ${SA_SECRET_TOKEN}
19EOF
Step 5: validate the generated Kubeconfig
To validate the Kubeconfig, execute it with the kubectl command to see if the cluster is getting authenticated.
1kubectl get nodes --kubeconfig=devops-cluster-admin-config
Let’s look at some of the frequently asked Kubeconfig file questions.
Where do I put the Kubeconfig file?
The default Kubeconfig file location is $HOME.kube/
folder in the home directory. Kubectl looks for the kubeconfig file using the conext name from the .kube folder. However, if you are using the KUBECONFIG
environment variable, you can place the kubeconfig file where you like and refer to the path in the KUBECONFIG
environment variable.
Where is the Kubeconfig file located?
All the kubeconfig files are located in the .kube directory in the user home directory.That is $HOME/.kube/config
How to manage multiple Kubeconfig files?
You can store all the kubeconfig files in $HOME/.kube
directory. You need to change the cluster context to connect to a specific cluster.
How to create a Kubeconfig file?
To create a Kubeconfig file, you need to have the cluster endpoint details, cluster CA certificate, and authentication token. Then you need to create a Kubernetes YAML object of type config with all the cluster details.
How to use Proxy with Kubeconfig
If you are behind a corporate proxy, you can use **proxy-url**: https://proxy.host:port
in your Kubeconfig file to connect to the cluster.
捐赠本站(Donate)
如您感觉文章有用,可扫码捐赠本站!(If the article useful, you can scan the QR code to donate))
- Author: shisekong
- Link: https://blog.361way.com/kubeconfig/6808.html
- License: This work is under a 知识共享署名-非商业性使用-禁止演绎 4.0 国际许可协议. Kindly fulfill the requirements of the aforementioned License when adapting or creating a derivative of this work.