Use kubectl with microk8s

I’ve been switching my dev environment from minikube to microk8s and have just set up my kubectl to work with microk8s without any fuss or conflicts. I’ve noticed some advice to overwrite existing kubectl config with microk8s, but this is a non-starter if you need to retain access to existing kubernetes clusters.

Fortunately integrating microk8s with an existing kubectl is super easy

# add the minik8s cluster to kubectl
kubectl config set-cluster microk8s-cluster --server=http://127.0.0.1:8080 --insecure-skip-tls-verify

# create the microk8s context
kubectl config set-context microk8s --user=admin --cluster=microk8s-cluster

# switch to the microk8s context
kubectl config use-context microk8s
2 Likes

Hi @gerbal,

Thank you for this post. It looks great.

Note that the insecure port 8080 is marked for deprecation from the upstream Kubernetes project, I do not know how long it will be around. Starting from the v1.14 release MicroK8s will start using the secure port 16443 while keeping the insecure port open for local use to maintain backwards compatibility.

Have you looked at the option of merging the kubeconfig files as described in Organizing Cluster Access Using kubeconfig Files - Kubernetes ?

Cheers

I did not know about the kubeconfig envvar.

I’ve simplified my config by adding this to my .bashrc

microk8s.kubectl config view --raw > $HOME/.kube/microk8s.config
export  KUBECONFIG=$HOME/.kube/config
export  KUBECONFIG=$KUBECONFIG:$HOME/.kube/microk8s.config

which, IMO, is safer than the advice in the project readme

I’ve been looking at the same thing this morning, so I can continue to use the extra plugins and command completion that I have already from using remote clusters. When I used the commands in the OP, I got prompted for a username/password on every command I ran. This is what I ended up with to fix that (also to use the TLS endpoint):

PASSWORD=$(microk8s.kubectl config view | grep password | cut -d' ' -f6-)
kubectl config set-cluster microk8s --server=https://127.0.0.1:16443/ --certificate-authority=/var/snap/microk8s/current/certs/ca.crt
kubectl config set-credentials microk8s-admin --username=admin --password=$PASSWORD
kubectl config set-context microk8s --cluster=microk8s --namespace=default --user=microk8s-admin

Now you can use kubectl config use-context microk8s to switch to that context when you need it, and your previous contexts still exist (visible with kubectl config get-contexts)

I found the above configure from @howardjones worked for me with a slight modification.
Rather than a password, there was a token… I got this from the microk8s.kubectl config view command.

And then passed that with --token aaaaaa instead of the username/password options.

So far all is well…

Here’s the script I used with jsonpath to extract the token

kubectl config set-cluster microk8s --server=https://127.0.0.1:16443/ --certificate-authority=/var/snap/microk8s/current/certs/ca.crt
kubectl config set-credentials microk8s-admin --token=$(microk8s kubectl config view --raw -o 'jsonpath={.users[0].user.token}')
kubectl config set-context microk8s --cluster=microk8s --namespace=default --user=microk8s-admin

I wrestled with the issue of accessing microk8s and gke via the IntelliJ K8s plugin.
I found that the plugin only has one server definition for defining a path the kubectl.
This does not work when you want to use microk8s and gke at the same time as microk8s seems to need to use microk8s.kubectl. Additionally, I found that kubectl was not able to find the “gke-gclound-auth” plugin when kubectl was referenced in the plugin.
The solutions to these issues was to create a wrapper script that would reference the correct version of kubectl depending on the “–context ” passed to the kubectl command. The scrip also adds the bin path to the gcloud installation so that the “gke-gclound-auth” plugin can be found by kubectl.
I’m sure that I am not the only one to have experience these issues, so I am sharing the script…
I place the script into my home ~/bin/ directory and point to it in the K8s plugin “Server Settings”.

#!/bin/bash

# This is a script that fixes issues with having access a mix of microk8s clusters
# (which require the use of the microk8s.kubectl command),
# vs real Kubernetes clusters that should only use the real "kubectl" command,
# via the IntelliJ Kubernetes plugin for JetBrains IDEs.

# It can also be extended to use different version of the "kubectl" command
# if that is required across different K8s clusters on different versions.

# When this script references a version of kubectl. It should alway reference
# it along a explicit path the ensure the proper version is used.

# set -x

# Place your pqth to the gcloud instulation.
# This should also be where GKE kubectl is installed.
# Best to install the latest gcloud via gooles instruactions.
gcloud_path=/home/<user>/Software/Google/gcloud-cli/google-cloud-sdk/bin
# This is a regex patter that identifies your microk8s clusters via the
# --context parameter that the plugin should always fill in.
# The microk8s cluster rely on using the microk8s.kubectl command.
microk8s_ctx="microk8s"
# This is a regex patter that identifies you gke or other "real" Kubernetes
# clusters that reqqire the "kubectl" command. 
gke_ctx="gke_"

# echo -n `date`": " >> /tmp/kubectl.log
# echo $PATH >> /tmp/kubectl.log
# echo `echo $ENV | grep -P (KUBE|localhost|127\.)` >> /tmp/kubectl.log
# echo "Params: [ $@ ]" >> /tmp/kubectl.log

ctx_str="--context"

has_ctx=`echo "$@" | grep -- ${ctx_str}`
if [ -z "${has_ctx}" ]; then
    # echo "===============================================" >> /tmp/kubectl.log
    # echo "my kubectl script: --context is required... :{P" >> /tmp/kubectl.log
    # echo "===============================================" >> /tmp/kubectl.log
    # echo "--No Context String--" >> /tmp/kubectl.log
    # Assume the use of "kubectl"
    # Gcloud is added to the path so that kubectl can find the "gke-gcloud-ath" plugin
    export PATH=${gcloud_path}:${PATH}
    ${gcloud_path}/kubectl $@
    exit $?
fi

use_microk8s=`echo "$@" | grep ${microk8s_ctx}`
use_gke=`echo "$@" | grep ${gke_ctx}`
if [ ! -z "${use_microk8s}" ]; then
    # echo "--microk8s--" >> /tmp/kubectl.log
    /snap/bin/microk8s.kubectl $@
    exit $?
elif [ ! -z "${use_gke}" ]; then
    # echo "--GKE--" >> /tmp/kubectl.log
    # Gcloud is added to the path so that kubectl can find the "gke-gcloud-ath" plugin
    export PATH=${gcloud_path}:${PATH}
    ${gcloud_path}/kubectl $@
    exit $?
fi

# echo "========================" >> /tmp/kubectl.log

Hope this is helpful.

Here is a link to my youtrack bug with the plugin…
https://youtrack.jetbrains.com/issue/IJPL-158349/Kubernetes-Plugin-gke-cloud-auth-plugin-not-found