0

I'm currently working with Minikube and the k8s api-server. I'm able to authorize HTTP requests using the default service account (decode default token into base64 and provide as authorization header), but I am struggling to do the same with my newly created user.

I have created all relevant .crt, .key files, as well as the role, rolebinding, clusterRole, clusterRoleBinding permissions for the user.

I previously tried to decode /Users/ionush/k8s/auth/gameadmin.crt into base64 and add to the authorization header, and set minikube start --extra-config=apiserver.client-ca-file=/Users/ionush/k8s/auth/gameadmin.crt but that didn't work. How can I authenticate as a user via HTTP?

Here is my .kube/config file:

apiVersion: v1
clusters:
- cluster:
    certificate-authority: /Users/ionush/.minikube/ca.crt
    server: https://192.168.64.7:8443
  name: minikube
contexts:
- context:
    cluster: minikube
    user: gameadmin
  name: game-context
- context:
    cluster: minikube
    user: minikube
  name: minikube
current-context: minikube
kind: Config
preferences: {}
users:
- name: gameadmin
  user:
    client-certificate: /Users/ionush/k8s/auth/gameadmin.crt
    client-key: /Users/ionush/k8s/auth/gameadmin.key
- name: minikube
  user:
    client-certificate: /Users/ionush/.minikube/profiles/minikube/client.crt
    client-key: /Users/ionush/.minikube/profiles/minikube/client.key
ionush
  • 323
  • 2
  • 6
  • 12
  • Its your local environment or cloud? What K8s and Minikube version are you using? How did you create your certificates? – PjoterS Oct 05 '20 at 11:05
  • It's my local environment Client Version: v1.19.2 Server Version: v1.19.2 minikube version: v1.13.1 I signed the certificate using openssl as described here. https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/. There is no problem with the certificates, I can use them when I switch user in a local terminal. Just need to know the correct process to authenticate over HTTP – ionush Oct 05 '20 at 23:02

1 Answers1

1

Following is example using curl to authenticate with kube-api server

curl --cacert /Users/ionush/.minikube/ca.crt --cert /Users/ionush/k8s/auth/gameadmin.crt --key /Users/ionush/k8s/auth/gameadmin.key https://192.168.64.7:8443/api/v1
confused genius
  • 2,876
  • 2
  • 16
  • 29