coreos - Kubernetes: how to enable API Server Bearer Token Auth? -


i've been trying enabled token auth http rest api server access remote client.

i installed coreos/k8s cluster controller using script: https://github.com/coreos/coreos-kubernetes/blob/master/multi-node/generic/controller-install.sh

my cluster works fine. tls installation need configure kubectl clients client certs access cluster.

i tried enable token auth via running:

 echo `dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64 | tr -d "=+/" | dd bs=32 count=1 2>/dev/null`

this gives me token. added token token file on controller containing token , default user:

$> cat /etc/kubernetes/token  3xq8w6iaourkxolh2yfpbgfxftbh0vn,default,default

i modified /etc/kubernetes/manifests/kube-apiserver.yaml add in:

 - --token-auth-file=/etc/kubernetes/token

to startup param list

i reboot (not sure best way restart api server itself??)

at point, kubectl remote server quits working(won't connect). @ docker ps on controller , see api server. run docker logs container_id , no output. if @ other docker containers see output like:

    e0327 20:05:46.657679       1 reflector.go:188]      pkg/proxy/config/api.go:33: failed list *api.endpoints:      http://127.0.0.1:8080/api/v1/endpoints?resourceversion=0:  dial tcp 127.0.0.1:8080: getsockopt: connection refused

so appears api-server.yaml config preventing api server starting properly....

any suggestions on proper way configure api server bearer token rest auth?

it possible have both tls configuration , bearer token auth configured, right?

thanks!

i think kube-apiserver dies because it's can't find /etc/kubernetes/token. that's because on deployment apiserver static pod therefore running in container in turn means has different root filesystem of host.

look /etc/kubernetes/manifests/kube-apiserver.yaml , add volume , volumemount (i have omitted lines not need changing , don't in locating correct section):

kind: pod metadata:   name: kube-apiserver spec:   containers:   - name: kube-apiserver     command:     - ...     - --token-auth-file=/etc/kubernetes/token     volumemounts:     - mountpath: /etc/kubernetes/token       name: token-kubernetes       readonly: true   volumes:   - hostpath:       path: /etc/kubernetes/token     name: token-kubernetes

one more note: file quoted token should not end in . (dot) - maybe copy-paste mistake check anyway. format documented under static token file:

token,user,uid,"group1,group2,group3"

if problem perists execute command below , post output:

journalctl -u kubelet | grep kube-apiserver

Comments

Post a Comment

Popular posts from this blog

javascript - Clear button on addentry page doesn't work -

this addentry blog page have made scratch , there underlying problems code particularly clear button supposed clear text entered when button clicked on doesn't work have saved html file problem. also 1 other problem submit button works doesn't pass of text index file have written php , reason whenever click on submit button redirects me index page without posting entry have made. <!doctype html> <html> <head> <script> function message() { alert("clear form?"); } </script> <style> body {background-color: beige;} h1 {color: black;} p {color: black;} textarea { width: 50%; height: 150px; padding: 12px 20px; box-sizing: border-box; border: 2px solid #ccc; border-radius: 4px; background-color: white; font-size: 16px; resize: none; } div { padding-left: 20px; } </style> </head> <meta charset="utf-8"> <link rel="stylesheet" href=".
Read more

c# - Selenium Authentication Popup preventing driver close or quit -

i have selenium automated task setup login website retrieve information. it's basic in automation. logging in , clicking 2 links. running issue proving problem. the site in question uses authentication required popup not javascript popup rather regular windows auth popup. have read isn't handled out of box selenium. i using " http://username:password@url.com " site every , site has issues on end prompt me again username/password randomly. have enter username/password twice in row when navigating there hand. since task loops continuously few hours picking needed info figured use webdriverwait verify element present on page. if authentication popup appears, element isn't present. no need care run, start over. the problem having when authentication popup displayed , hit timeout limit want close driver/browser window can start task on again. however, driver.close() , driver.quit() not doing anything. browser remains open , unloaded page still there login p
Read more

tensorflow when input_data MNIST_data , zlib.error: Error -3 while decompressing: invalid block type -

i'm geting started tensorflow,followed tutorials,but cannot download mnist data. import tensorflow tf tensorflow.examples.tutorials.mnist import input_data mnist=input_data.read_data_sets("mnist_data/",one_hot=true) print("download done!") error information: extracting mnist_data/train-images-idx3-ubyte.gz traceback (most recent call last): file "/home/sj/program/tesorflow_try.py", line 6, in <module> mnist=input_data.read_data_sets("mnist_data/",one_hot=true) file "/usr/local/lib/python2.7/dist-packages/tensorflow/contrib/learn/python/learn/datasets/mnist.py", line 213, in read_data_sets train_images = extract_images(f) file "/usr/local/lib/python2.7/dist-packages/tensorflow/contrib/learn/python/learn/datasets/mnist.py", line 60, in extract_images buf = bytestream.read(rows * cols * num_images) file "/usr/lib/python2.7/gzip.py", line 268, in read self._read(readsize) file
Read more