Red Hat Summit이 콘텐츠는 선택한 언어로 제공되지 않습니다.
Chapter 8. Node access with kubeconfig files
Learn about how kubeconfig files are used with MicroShift deployments. CLI tools use kubeconfig files to communicate with the API server of a node. These files provide node details, IP addresses, and other information needed for authentication.
8.1. Kubeconfig files for configuring node access
The two categories of kubeconfig files used in MicroShift are local access and remote access. Every time MicroShift starts, a set of kubeconfig files for local and remote access to the API server are generated. These files are generated in the /var/lib/microshift/resources/kubeadmin/ directory by using preexisting configuration information.
Each access type requires a different authentication certificate signed by different Certificate Authorities (CAs). The generation of multiple kubeconfig files accommodates this need.
You can use the appropriate kubeconfig file for the access type needed in each case to provide authentication details. The contents of MicroShift kubeconfig files are determined by either default built-in values or a config.yaml file.
A kubeconfig file must exist for the cluster to be accessible. The values are applied from built-in default values or a customized config.yaml file.
Example contents of the kubeconfig files
8.2. Local access kubeconfig file
The local access kubeconfig file is written to /var/lib/microshift/resources/kubeadmin/kubeconfig. This kubeconfig file provides access to the API server by using localhost. Choose this file when you are connecting the node locally.
Example contents of kubeconfig for local access
clusters:
- cluster:
certificate-authority-data: <base64 CA>
server: https://localhost:6443
clusters:
- cluster:
certificate-authority-data: <base64 CA>
server: https://localhost:6443
The localhost kubeconfig file can only be used from a client connecting to the API server from the same host. The certificates in the file do not work for remote connections.
8.2.1. Accessing the MicroShift node locally
Use the following procedure to access the MicroShift node locally by using a kubeconfig file.
Prerequisites
-
You installed OpenShift CLI (
oc).
Procedure
Optional: to create a
~/.kube/folder if your Red Hat Enterprise Linux (RHEL) machine does not have one, run the following command:mkdir -p ~/.kube/
$ mkdir -p ~/.kube/Copy to Clipboard Copied! Toggle word wrap Toggle overflow Copy the generated local access
kubeconfigfile to the~/.kube/directory by running the following command:sudo cat /var/lib/microshift/resources/kubeadmin/kubeconfig > ~/.kube/config
$ sudo cat /var/lib/microshift/resources/kubeadmin/kubeconfig > ~/.kube/configCopy to Clipboard Copied! Toggle word wrap Toggle overflow Update the permissions on your
~/.kube/configfile by running the following command:chmod go-r ~/.kube/config
$ chmod go-r ~/.kube/configCopy to Clipboard Copied! Toggle word wrap Toggle overflow
Verification
Verify that MicroShift is running by entering the following command:
oc get pods -A
$ oc get pods -ACopy to Clipboard Copied! Toggle word wrap Toggle overflow Example output
Copy to Clipboard Copied! Toggle word wrap Toggle overflow NoteThis example output shows a basic MicroShift installation. If you installed optional RPMs, the status of pods running those services is also expected in your output.
8.3. Remote access kubeconfig files
When a MicroShift node connects to the API server from an external source, a certificate with all of the alternative names in the SAN field is used for validation. MicroShift generates a default kubeconfig for external access by using the hostname value. The defaults are set in the <node.hostnameOverride>, <node.nodeIP> and api.<dns.baseDomain> parameter values of the default kubeconfig file.
The /var/lib/microshift/resources/kubeadmin/<hostname>/kubeconfig file uses the hostname of the machine, or node.hostnameOverride if that option is set, to reach the API server. The CA of the kubeconfig file is able to validate certificates when accessed externally.
Example contents of a default kubeconfig file for remote access
clusters:
- cluster:
certificate-authority-data: <base64 CA>
server: https://microshift-rhel9:6443
clusters:
- cluster:
certificate-authority-data: <base64 CA>
server: https://microshift-rhel9:64438.3.1. Remote access customization
Multiple remote access kubeconfig file values can be generated for accessing the node with different IP addresses or host names. An additional kubeconfig file generates for each entry in the apiServer.subjectAltNames parameter. You can copy remote access kubeconfig files from the host during times of IP connectivity and then use them to access the API server from other workstations.
8.4. Generating additional kubeconfig files for remote access
You can generate additional kubeconfig files to use if you need more host names or IP addresses than the default remote access file provides.
You must restart MicroShift for configuration changes to be implemented.
Prerequisites
-
You have created a
config.yamlfor MicroShift.
Procedure
Optional: You can show the contents of the
config.yaml. Run the following command:cat /etc/microshift/config.yaml
$ cat /etc/microshift/config.yamlCopy to Clipboard Copied! Toggle word wrap Toggle overflow Optional: You can show the contents of the remote-access
kubeconfigfile. Run the following command:cat /var/lib/microshift/resources/kubeadmin/<hostname>/kubeconfig
$ cat /var/lib/microshift/resources/kubeadmin/<hostname>/kubeconfigCopy to Clipboard Copied! Toggle word wrap Toggle overflow ImportantAdditional remote access
kubeconfigfiles must include one of the server names listed in the Red Hat build of MicroShiftconfig.yamlfile. Additionalkubeconfigfiles must also use the same CA for validation.To generate additional
kubeconfigfiles for additional DNS names SANs or external IP addresses, add the entries you need to theapiServer.subjectAltNamesfield. In the following example, the DNS name used isalt-name-1and the IP address is1.2.3.4.Example
config.yamlwith additional authentication valuesCopy to Clipboard Copied! Toggle word wrap Toggle overflow Restart MicroShift to apply configuration changes and auto-generate the
kubeconfigfiles you need by running the following command:sudo systemctl restart microshift
$ sudo systemctl restart microshiftCopy to Clipboard Copied! Toggle word wrap Toggle overflow To check the contents of additional remote-access
kubeconfigfiles, insert the name or IP address as listed in theconfig.yamlinto thecatcommand. For example,alt-name-1is used in the following example command:cat /var/lib/microshift/resources/kubeadmin/alt-name-1/kubeconfig
$ cat /var/lib/microshift/resources/kubeadmin/alt-name-1/kubeconfigCopy to Clipboard Copied! Toggle word wrap Toggle overflow Choose the
kubeconfigfile to use that contains the SAN or IP address you want to use to connect your node. In this example, thekubeconfigcontaining`alt-name-1` in thecluster.serverfield is the correct file.Example contents of an additional
kubeconfigfileclusters: - cluster: certificate-authority-data: <base64 CA> server: https://alt-name-1:6443clusters: - cluster: certificate-authority-data: <base64 CA> server: https://alt-name-1:64431 Copy to Clipboard Copied! Toggle word wrap Toggle overflow - 1
- The
/var/lib/microshift/resources/kubeadmin/alt-name-1/kubeconfigfile values are from theapiServer.subjectAltNamesconfiguration values.
All of these parameters are included as common names (CN) and subject alternative names (SAN) in the external serving certificates for the API server.
8.4.1. Opening the firewall for remote access to the MicroShift node
Use the following procedure to open the firewall so that a remote user can access the MicroShift service. You must complete this procedure before a workstation user can access the node remotely.
For this procedure, user@microshift is the user on the MicroShift host machine and is responsible for setting up that machine so that it can be accessed by a remote user on a separate workstation.
Prerequisites
-
You installed OpenShift CLI (
oc). - Your account has cluster administration privileges.
Procedure
As
user@microshifton the MicroShift host, open the firewall port for the Kubernetes API server (6443/tcp) by running the following command:sudo firewall-cmd --permanent --zone=public --add-port=6443/tcp && sudo firewall-cmd --reload
[user@microshift]$ sudo firewall-cmd --permanent --zone=public --add-port=6443/tcp && sudo firewall-cmd --reloadCopy to Clipboard Copied! Toggle word wrap Toggle overflow
Verification
As
user@microshift, verify that MicroShift is running by entering the following command:oc get pods -A
$ oc get pods -ACopy to Clipboard Copied! Toggle word wrap Toggle overflow Example output
Copy to Clipboard Copied! Toggle word wrap Toggle overflow NoteThis example output shows a basic MicroShift installation. If you installed optional RPMs, the status of pods running those services is also expected in your output.
8.4.2. Accessing the MicroShift node remotely
Use the following procedure to access the MicroShift service from a remote location by using a kubeconfig file.
The user@workstation login is used to access the host machine remotely. The <user> value in the procedure is the name of the user that user@workstation logs in with to the MicroShift host.
Prerequisites
-
You installed OpenShift CLI (
oc). -
The
user@microshifthas opened the firewall from the local host. -
You generated additional
kubeconfigfiles.
Procedure
As
user@workstation, create a~/.kube/folder if your Red Hat Enterprise Linux (RHEL) machine does not have one by running the following command:mkdir -p ~/.kube/
[user@workstation]$ mkdir -p ~/.kube/Copy to Clipboard Copied! Toggle word wrap Toggle overflow As
user@workstation, set a variable for the hostname of your MicroShift host by running the following command:MICROSHIFT_MACHINE=<microshift_hostname>
[user@workstation]$ MICROSHIFT_MACHINE=<microshift_hostname>1 Copy to Clipboard Copied! Toggle word wrap Toggle overflow - 1
- Replace the value, <MicroShift_hostname>, with the either the name or the IP address of the host running .
As
user@workstation, copy the generatedkubeconfigfile that contains the hostname or IP address you want to connect to from the RHEL machine running MicroShift to your local machine by running the following command:ssh <user>@$MICROSHIFT_MACHINE "sudo cat /var/lib/microshift/resources/kubeadmin/$MICROSHIFT_MACHINE/kubeconfig" > ~/.kube/config
[user@workstation]$ ssh <user>@$MICROSHIFT_MACHINE "sudo cat /var/lib/microshift/resources/kubeadmin/$MICROSHIFT_MACHINE/kubeconfig" > ~/.kube/config1 Copy to Clipboard Copied! Toggle word wrap Toggle overflow - 1
- Replace <user> with your SSH login credentials.
As
user@workstation, update the permissions on your~/.kube/configfile by running the following command:chmod go-r ~/.kube/config
$ chmod go-r ~/.kube/configCopy to Clipboard Copied! Toggle word wrap Toggle overflow
Verification
As
user@workstation, verify that MicroShift is running by entering the following command:oc get pods -A
$ oc get pods -ACopy to Clipboard Copied! Toggle word wrap Toggle overflow Example output
Copy to Clipboard Copied! Toggle word wrap Toggle overflow NoteThis example output shows a basic MicroShift installation. If you installed optional RPMs, the status of pods running those services is also expected in your output.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}