Add certificate based authentication to localkube/minikube. #48
Conversation
This still relies on a modified localkube build, which should be fixed when we merge localkube, before this gets merged in.
| fi | ||
| # Fetch easy-rsa. | ||
| sudo mkdir -p /srv/kubernetes/certs && sudo chmod -R 777 /srv | ||
| if [ ! -e easy-rsa.tar.gz ]; then |
There was a problem hiding this comment.
What about creating the certs with go instead?
Maybe that's easier...
There was a problem hiding this comment.
I tried a few different ways, using https://github.com/SvenDowideit/generate_cert/blob/master/generate_cert.go but was unable to get anything working in pure go :(
|
What about something like redspread/localkube#50? |
I might be missing something, but that isn't quite the same. That PR doesn't setup any client certificates for actually accessing the API server, which is where I ran into trouble. |
|
Ah, I was thinking about the service accounts only. There are some small things that could be improved here, but I think that's better for follow-ups |
|
FYI, this broke |
Latest upstream merge
This PR uses easyrsa to generate certificates on the host, and configures localkube to use them. Currently we just print out the steps to configure kubectl to use these certificates, but I'll automate this in a follow-up PR.
cc @ethernetdan @luxas