ETCD backup !ssues

General Discussions
5

FYI for authentication and auth of new users -

  1. Create a CSR with openssl -

     openssl req -new -newkey rsa:4096 -nodes -keyout ops-k8s.key -out ops-k8s.csr -subj "/CN=ops/O=devops"

    The above cmd is to create a CSR for user ops

  2. Copy the o/p of

     cat ops-k8s.csr | base64 | tr -d '\n' "

  3. Paste in csr.yaml file(it is mentioned where to paste in file)

  4. Create the CSR k8 obj -

     kubectl apply -f csr.yaml

  5. Approve the CSR -

     kubectl certificate approve ops-k8s-access

  6. now get the certificate that is approved -

     kubectl get csr ops-k8s-access -o jsonpath='{.status.certificate}' | base64 --decode > ops-k8s-access.crt

  7. Now to create the kubeconfig, we need CA cert, ops cert(one we have above) -

     kubectl config view -o jsonpath='{.clusters[0].cluster.certificate-authority-data}' --raw | base64 --decode - > k8s-ca.crt

  8. Running the below will create a kubeconfig template with current CA’s certificate -

     kubectl config set-cluster $(kubectl config view -o jsonpath='{.clusters[0].name}') --server=$(kubectl config view -o jsonpath='{.clusters[0].cluster.server}') --certificate-authority=k8s-ca.crt --kubeconfig=ops-k8s-config --embed-certs

  9. This will add ops cert into the kubeconfig -

     kubectl config set-credentials ops --client-certificate=ops-k8s-access.crt --client-key=ops-k8s.key --embed-certs --kubeconfig=ops-k8s-config

  10. This will add context mapping for the ops user

    kubectl config set-context ops --cluster=$(kubectl config view -o jsonpath='{.clusters[0].name}') --namespace=default --user=ops --kubeconfig=ops-k8s-config

  11. kubectl config use-context ops --kubeconfig=ops-k8s-config

#Now pass on the “ops-k8s-config” as kubeconfig file for the ops team!

  1. apply role and rolebinding
    kubectl apply -f role.yaml
    kubectl apply -f rolebinding.yaml

Role:

apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: default
  name: create-pod
rules:
- apiGroups: [""]
  resources: ["pods"]
  verbs: ["create", "delete"]

RoleBinding:

apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: role-grantor-binding
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: create-pod
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: ops

CSR object template

apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
  name: ops-k8s-access
spec:
  groups:
  - system:authenticated
  request: #replace with output from shell command: cat ops-k8s.csr | base64 | tr -d '\n'
  usages:
  - client auth