github/container.training
1
0
Fork 0
mirror of https://github.com/jpetazzo/container.training.git synced 2026-07-28 09:11:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add the external IP address to the API server certs

Browse Source 
This allows us to NOT skip TLS verification when playing with
a remote cluster. It's minor but it makes that section less
hackish.
This commit is contained in:
Jerome Petazzoni
2019-03-27 12:15:41 -05:00
parent 6f655bff03
commit 1ee4c31135
2 changed files with 20 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
prepare-vms/lib/commands.sh
View File

@@ -123,7 +123,7 @@ _cmd_kube() {
pssh --timeout 200 "
if grep -q node1 /tmp/node && [ ! -f /etc/kubernetes/admin.conf ]; then
kubeadm token generate > /tmp/token &&
sudo kubeadm init --token \$(cat /tmp/token)
sudo kubeadm init --token \$(cat /tmp/token) --apiserver-cert-extra-sans \$(cat /tmp/ipv4)
fi"
# Put kubeconfig in ubuntu's and docker's accounts

23
slides/k8s/localkubeconfig.md
View File

@@ -49,7 +49,10 @@ Note: if you are following along with a different platform (e.g. Linux on an arc
The output should look like this:
```
Client Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.0", GitCommit:"641856db18352033a0d96dbc99153fa3b27298e5", GitTreeState:"clean", BuildDate:"2019-03-25T15:53:57Z", GoVersion:"go1.12.1", Compiler:"gc", Platform:"linux/amd64"}
Client Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.0",
GitCommit:"641856db18352033a0d96dbc99153fa3b27298e5", GitTreeState:"clean",
BuildDate:"2019-03-25T15:53:57Z", GoVersion:"go1.12.1", Compiler:"gc",
Platform:"linux/amd64"}
```
---
@@ -104,7 +107,6 @@ Client Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.0", GitCom
- To update the server address, run:
```bash
kubectl config set-cluster kubernetes --server=https://`X.X.X.X`:6443
kubectl config set-cluster kubernetes --insecure-skip-tls-verify
# Make sure to replace X.X.X.X with the IP address of node1!
```
@@ -112,7 +114,7 @@ Client Version: version.Info{Major:"1", Minor:"14", GitVersion:"v1.14.0", GitCom
class: extra-details
## Why do we skip TLS verification?
## What if we get a certificate error?
- Generally, the Kubernetes API uses a certificate that is valid for:
@@ -130,7 +132,20 @@ class: extra-details
- ... And that external IP address was not used when creating the certificate!
.warning[It's better to NOT skip TLS verification; this is for educational purposes only!]
---
class: extra-details
## Working around the certificate error
- We need to tell `kubectl` to skip TLS verification
(only do this with testing clusters, never in production!)
- The following command will do the trick:
```bash
kubectl config set-cluster kubernetes --insecure-skip-tls-verify
```
---