红帽全球峰会8.4. Generating additional kubeconfig files for remote access
You can generate additional kubeconfig files to use if you need more host names or IP addresses than the default remote access file provides.
You must restart MicroShift for configuration changes to be implemented.
Prerequisites
-
You have created a
config.yamlfor MicroShift.
Procedure
Optional: You can show the contents of the
config.yaml. Run the following command:$ cat /etc/microshift/config.yamlOptional: You can show the contents of the remote-access
kubeconfigfile. Run the following command:$ cat /var/lib/microshift/resources/kubeadmin/<hostname>/kubeconfig重要Additional remote access
kubeconfigfiles must include one of the server names listed in the Red Hat build of MicroShiftconfig.yamlfile. Additionalkubeconfigfiles must also use the same CA for validation.To generate additional
kubeconfigfiles for additional DNS names SANs or external IP addresses, add the entries you need to theapiServer.subjectAltNamesfield. In the following example, the DNS name used isalt-name-1and the IP address is1.2.3.4.Example
config.yamlwith additional authentication valuesdns: baseDomain: example.com node: hostnameOverride: "microshift-rhel9"1 nodeIP: 10.0.0.1 apiServer: subjectAltNames: - alt-name-12 - 1.2.3.43 Restart MicroShift to apply configuration changes and auto-generate the
kubeconfigfiles you need by running the following command:$ sudo systemctl restart microshiftTo check the contents of additional remote-access
kubeconfigfiles, insert the name or IP address as listed in theconfig.yamlinto thecatcommand. For example,alt-name-1is used in the following example command:$ cat /var/lib/microshift/resources/kubeadmin/alt-name-1/kubeconfigChoose the
kubeconfigfile to use that contains the SAN or IP address you want to use to connect your node. In this example, thekubeconfigcontaining`alt-name-1` in thecluster.serverfield is the correct file.Example contents of an additional
kubeconfigfileclusters: - cluster: certificate-authority-data: <base64 CA> server: https://alt-name-1:64431 - 1
- The
/var/lib/microshift/resources/kubeadmin/alt-name-1/kubeconfigfile values are from theapiServer.subjectAltNamesconfiguration values.
All of these parameters are included as common names (CN) and subject alternative names (SAN) in the external serving certificates for the API server.
Use the following procedure to open the firewall so that a remote user can access the MicroShift service. You must complete this procedure before a workstation user can access the node remotely.
For this procedure, user@microshift is the user on the MicroShift host machine and is responsible for setting up that machine so that it can be accessed by a remote user on a separate workstation.
Prerequisites
-
You installed OpenShift CLI (
oc). - Your account has cluster administration privileges.
Procedure
As
user@microshifton the MicroShift host, open the firewall port for the Kubernetes API server (6443/tcp) by running the following command:[user@microshift]$ sudo firewall-cmd --permanent --zone=public --add-port=6443/tcp && sudo firewall-cmd --reload
Verification
As
user@microshift, verify that MicroShift is running by entering the following command:$ oc get pods -AExample output
NAMESPACE NAME READY STATUS RESTARTS AGE default i-06166fbb376f14a8bus-west-2computeinternal-debug-qtwcr 1/1 Running 0 46m kube-system csi-snapshot-controller-5c6586d546-lprv4 1/1 Running 0 51m openshift-dns dns-default-45jl7 2/2 Running 0 50m openshift-dns node-resolver-7wmzf 1/1 Running 0 51m openshift-ingress router-default-78b86fbf9d-qvj9s 1/1 Running 0 51m openshift-ovn-kubernetes ovnkube-master-5rfhh 4/4 Running 0 51m openshift-ovn-kubernetes ovnkube-node-gcnt6 1/1 Running 0 51m openshift-service-ca service-ca-bf5b7c9f8-pn6rk 1/1 Running 0 51m openshift-storage topolvm-controller-549f7fbdd5-7vrmv 5/5 Running 0 51m openshift-storage topolvm-node-rht2m 3/3 Running 0 50m注意This example output shows a basic MicroShift installation. If you installed optional RPMs, the status of pods running those services is also expected in your output.
8.4.2. Accessing the MicroShift node remotely
Use the following procedure to access the MicroShift service from a remote location by using a kubeconfig file.
The user@workstation login is used to access the host machine remotely. The <user> value in the procedure is the name of the user that user@workstation logs in with to the MicroShift host.
Prerequisites
-
You installed OpenShift CLI (
oc). -
The
user@microshifthas opened the firewall from the local host. -
You generated additional
kubeconfigfiles.
Procedure
As
user@workstation, create a~/.kube/folder if your Red Hat Enterprise Linux (RHEL) machine does not have one by running the following command:[user@workstation]$ mkdir -p ~/.kube/As
user@workstation, set a variable for the hostname of your MicroShift host by running the following command:[user@workstation]$ MICROSHIFT_MACHINE=<microshift_hostname>1 - 1
- Replace the value, <MicroShift_hostname>, with the either the name or the IP address of the host running .
As
user@workstation, copy the generatedkubeconfigfile that contains the hostname or IP address you want to connect to from the RHEL machine running MicroShift to your local machine by running the following command:[user@workstation]$ ssh <user>@$MICROSHIFT_MACHINE "sudo cat /var/lib/microshift/resources/kubeadmin/$MICROSHIFT_MACHINE/kubeconfig" > ~/.kube/config1 - 1
- Replace <user> with your SSH login credentials.
As
user@workstation, update the permissions on your~/.kube/configfile by running the following command:$ chmod go-r ~/.kube/config
Verification
As
user@workstation, verify that MicroShift is running by entering the following command:$ oc get pods -AExample output
NAMESPACE NAME READY STATUS RESTARTS AGE default i-06166fbb376f14a8bus-west-2computeinternal-debug-qtwcr 1/1 Running 0 46m kube-system csi-snapshot-controller-5c6586d546-lprv4 1/1 Running 0 51m openshift-dns dns-default-45jl7 2/2 Running 0 50m openshift-dns node-resolver-7wmzf 1/1 Running 0 51m openshift-ingress router-default-78b86fbf9d-qvj9s 1/1 Running 0 51m openshift-ovn-kubernetes ovnkube-master-5rfhh 4/4 Running 0 51m openshift-ovn-kubernetes ovnkube-node-gcnt6 1/1 Running 0 51m openshift-service-ca service-ca-bf5b7c9f8-pn6rk 1/1 Running 0 51m openshift-storage topolvm-controller-549f7fbdd5-7vrmv 5/5 Running 0 51m openshift-storage topolvm-node-rht2m 3/3 Running 0 50m注意This example output shows a basic MicroShift installation. If you installed optional RPMs, the status of pods running those services is also expected in your output.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}