Kuberenetes User Creation

-

 

In this post we will see how to create a user in kuberenetes.

There are 3 building blocks needed for user creation in kubernetes:

1) Private Key.

2) CSR (Certificate Signing Request).

3) Certificate.

Lets start by creating all 3 first using openssl command.

root@masterk8s:/docker# openssl genrsa -out sam.key 2048

Generating RSA private key, 2048 bit long modulus (2 primes)

................+++++

..........................+++++

e is 65537 (0x010001)

root@masterk8s:/docker#

Create a CSR with the private key generated and add the user to the group "developer". We will be creating a namespace called "developer" too.

root@masterk8s:/docker# openssl req -new -key sam.key -out sam.csr -subj "/CN=sam/O=developer"

Next, We need to sign the CSR with the K8s default CA CRT and KEY file located under /etc/kubernetes/pki

root@masterk8s:/docker# openssl x509 -req -in sam.csr \

> -CA /etc/kubernetes/pki/ca.crt -CAkey /etc/kubernetes/pki/ca.key \

> -CAcreateserial -out sam.crt -days 365

Signature ok

subject=CN = sam, O = developer

Getting CA Private Key

root@masterk8s:/docker#


We are done with creating the user. Now, We need to generate kubeconfig for the user "sam".

Imagine "kubeconfig" as an enviromental file required to connect to the kubernetes cluster.

Default kubeconfig file is under "/root/.kube/config"

I am going to use the existing details like cluster name, API endpoint and CA from "/root/.kube/config"

root@masterk8s:/docker# kubectl --kubeconfig sam.kubeconfig config set-cluster kubernetes \
> --server https://192.168.163.128:6443 \
> --certificate-authority=/etc/kubernetes/pki/ca.crt
Cluster "kubernetes" set.
root@masterk8s:/docker#

Above command generates a default kubeconfig file.

root@masterk8s:/docker# cat sam.kubeconfig
apiVersion: v1
clusters:
- cluster:
    certificate-authority: /etc/kubernetes/pki/ca.crt
    server: https://192.168.163.128:6443
  name: kubernetes
contexts: null
current-context: ""
kind: Config
preferences: {}
users: null
root@masterk8s:/docker#

Now, We need to add "sam" to the kubeconfig file.

root@masterk8s:/docker# kubectl --kubeconfig sam.kubeconfig config set-context sam-kubernetes \
> --cluster kubernetes --namespace developer --user sam
Context "sam-kubernetes" created.
root@masterk8s:/docker#

root@masterk8s:/docker# cat sam.kubeconfig
apiVersion: v1
clusters:
- cluster:
    certificate-authority: /etc/kubernetes/pki/ca.crt
    server: https://192.168.163.128:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    namespace: developer
    user: sam
  name: sam-kubernetes
current-context: ""
kind: Config
preferences: {}
users: null
root@masterk8s:/docker#

Now, We need to set credentials for the user "sam". Here, Credentials are the sam's crt and key file.

root@masterk8s:/docker# kubectl --kubeconfig sam.kubeconfig config set-credentials sam \
> --client-certificate sam.crt --client-key sam.key
User "sam" set.
root@masterk8s:/docker#

root@masterk8s:/docker# cat sam.kubeconfig
apiVersion: v1
clusters:
- cluster:
    certificate-authority: /etc/kubernetes/pki/ca.crt
    server: https://192.168.163.128:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    namespace: developer
    user: sam
  name: sam-kubernetes
current-context: ""
kind: Config
preferences: {}
users:
- name: sam
  user:
    client-certificate: sam.crt
    client-key: sam.key
root@masterk8s:/docker#

We are done. Lets list the pods under namespace "developer".

root@masterk8s:/docker# kubectl --kubeconfig sam.kubeconfig get pods -n developer
The connection to the server localhost:8080 was refused - did you specify the right host or port?
root@masterk8s:/docker#

Above error is due to missing current context in sam.kubeconfig. Update current-context: "" to current-context:"sam-kubernetes"

root@masterk8s:/docker# cat sam.kubeconfig
apiVersion: v1
clusters:
- cluster:
    certificate-authority: /etc/kubernetes/pki/ca.crt
    server: https://192.168.163.128:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    namespace: developer
    user: sam
  name: sam-kubernetes
current-context: "sam-kubernetes"
kind: Config
preferences: {}
users:
- name: sam
  user:
    client-certificate: sam.crt
    client-key: sam.key
root@masterk8s:/docker#

root@masterk8s:/docker# kubectl --kubeconfig sam.kubeconfig get pods -n developer
Error from server (Forbidden): pods is forbidden: User "sam" cannot list resource "pods" in API group "" in the namespace "developer"
root@masterk8s:/docker# 

We are successfully authenticated. Above error is due to the access to the resource "pods" and this can be fixed using role and role-binding.

Will discuss that in the next post...


Comments

Post a Comment

Popular posts from this blog

SRE/DevOps Syllabus

-
Image
  DEVOPS/SRE Principles. Git What is Git? Architecture of Git. Working principle of Git. Create and cloning a repo. Version control branching. Version control commit. Version control managing workflows. Git hooks. Git Reflog. Git Stash. Git Cherry Picking. Undoing changes in different states of Git. Git based terraform template management. AWS CI/CD SDLC Automation. Code Commit. Code Build. Code Deployment. Code Pipeline. Elastic Beankstalk. Code Artifact. CodeGuru. Terraform Terraform Basics. Terraform State. Working with Terraform. Terraform with AWS. Remote State. Terraform Provisioners. Terraform Import, Tainting and Debugging. Terraform Modules. Terraform Functions and Conditional Expressions. Automation using Python - AWS AWS lambda. Automating EC2 with Lambda. Automating S3 with Lambda. Automating VPC with Lambda. Cost optimization with Lambda. SNS,SQS and SES with Python. Managing and Automating AWS Security with Python. Kubernetes - CKAD Application Developer. Kubernetes A...
Read more

AWS Code Commit - CI/CD Series Part 1

-
Image
  This is a multi-part series to show how to implement a CI/CD pipeline in AWS. In this post, We will see how to use AWS Code Commit. AWS CodeCommit is a fully managed source control service that allows you to store and manage your code securely in the cloud.  It provides a private Git repository for your code and supports all Git commands and workflows. CodeCommit also integrates with other AWS services like AWS CodePipeline and AWS CodeBuild, allowing you to automate your entire software release process. This can help you streamline your development workflows and improve the overall efficiency of your team. I created a repo from AWS CodeCommit -> Create Repository. And I begin with cloning the repo locally. So that I can make changes and push it. To clone the repo click on "HTTPS" under Clone URL. I make changes to index.html file. Now push it to AWS CodeCommit. Let’s verify the changes in AWS Code commit. Changes are reflected in AWS CodeCommit. We are done with Part ...
Read more

Docker - Preventing IP overlapping

-
Image
  What is IP address overlapping? When the container IP address overlaps with another IP external, then the application running on the container is not accessible from outside due to the IP address overlapping.  NOTE: This IP address overlapping can happen on the bridge interface IP or docker container IP. Let's see how to address this IP overlapping issue on the bridge interface. I already have a running container.  root@demo:~# docker run -d --name web --network mynet1 nginx:alpine 268647e11011d513d2357ce1c81e0f48787038a83d01d028d31a5b29dbdb885b root@demo:~# docker container ls CONTAINER ID   IMAGE          COMMAND                  CREATED         STATUS         PORTS     NAMES 268647e11011   nginx:alpine   "/docker-entrypoint.…"   4 seconds ago   Up 3 seconds   80/tcp  ...
Read more