Parameters to access multiple clusters

Question

I want to access an external k8s cluster which is running in private cloud. Do you have any idea how can I get these parameters? What should I do in order to generate them?

${CLIENT_CERTIFICATE_DATA} fake-cert-file fake-key-file

apiVersion: v1
kind: Config
clusters:
- cluster:
    certificate-authority-data: ${CLUSTER_CA}
    server: ${CLUSTER_ENDPOINT}
  name: ${CLUSTER_NAME}
users:
- name: ${USER}
  user:
    client-certificate-data: $**{CLIENT_CERTIFICATE_DATA}**
contexts:
- context:
    cluster: ${CLUSTER_NAME}
  user:
    client-certificate: **fake-cert-file**
    client-key: **fake-key-file**
  name: ${USER}-${CLUSTER_NAME}
current-context: ${USER}-${CLUSTER_NAME}

Answer 1

The steps to allow an access for a "bob" user are the followings:

Create a new CSR via openssl

openssl req -new -newkey rsa:4096 -nodes -keyout bob-k8s.key -out bob-k8s.csr -subj "/CN=bob/O=devops"

Create Kubernetes CertificateSigningRequest object

use kubectl create –edit -f k8s-csr.yaml

and you should input the following

apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
  name: bob-k8s-access
spec:
  groups:
  - system:authenticated
  request: # replace with output from shell command: cat bob-k8s.csr | base64 | tr -d '\n'
  usages:
  - client auth

Verify your CSR object

kubectl get csr

Approve your certificate

kubectl certificate approve bob-k8s-access

Verify your Bob's certificate

kubectl get csr bob-k8s-access -o jsonpath='{.status.certificate}' | base64 --decode > bob-k8s-access.crt

Retrieve the cluster CA certificate

kubectl config view -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' --raw | base64 --decode - > k8s-ca.crt

Setup Bob's kubeconfig file

$ kubectl config set-cluster $(kubectl config view -o jsonpath='{.clusters[0].name}') --server=$(kubectl config view -o jsonpath='{.clusters[0].cluster.server}') --certificate-authority=k8s-ca.crt --kubeconfig=bob-k8s-config --embed-certs

after this command a bob-k8s-config file should be created with Bob's .kube configuration

Setup Bob's credential accesses

kubectl config set-credentials bob --client-certificate=bob-k8s-access.crt --client-key=bob-k8s.key --embed-certs --kubeconfig=bob-k8s-config

Create a context in your config

kubectl config set-context bob --cluster=$(kubectl config view -o jsonpath='{.clusters[0].name}') --namespace=<ns-for-bob> --user=bob --kubeconfig=bob-k8s-config

Assign roles within the namespace

kubectl create rolebinding bob-admin --namespace=<ns-for-bob> --clusterrole=admin --user=bob

For more information about permissions, please, look at the Kubernetes configuration page

---

I've written this instructions starting from this guide that is more exhaustive!