Once you have a Kubernetes cluster, you can deploy, inspect and publish your application (container) on your cluster.
There are many reasons why you want to reach your cluster from you local machine. Think of testing your containers or kubernetes manifests, debugging problems and so on.
To access a cluster, you need the kubectl or helm cli and a KUBECONFIG (file).
kubectl krew install oidc-login
http://localhost:8000, for OIDC callback. Keep it please free.kubectl get pods. It will open a browser, and you can login.KUBECONFIG is a yaml file and (variable name) which contains information on how to reach and access a Kubernetes cluster.
... and download your Cluster's KUBECONFIG.~/.kube/cluster-x/kubeconfig.yamlchmod 600 ~/.kube/cluster-x/kubeconfig.yaml to avoid warnings.export KUBECONFIG=~/.kube/cluster-x/kubeconfig.yamlkubectl get --namespace <your-ns> podsSoftwaredam uses OIDC and k8s-RBAC for fully managed clusters for customers whom need more support. Here is an example.
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: DELETED_CERT
server: https://some-domain-or-i:16443
name: my-cluster
contexts:
- context:
cluster: my-cluster
namespace: my-ns
user: oidc-user
name: my-cluster
current-context: my-cluster
kind: Config
users:
- name: oidc-user
user:
exec:
apiVersion: client.authentication.k8s.io/v1beta1
args:
- oidc-login
- get-token
- --oidc-issuer-url=
- --oidc-client-id=
- --oidc-extra-scope=openid
command: kubectl
env: null
interactiveMode: IfAvailable
provideClusterInfo: false
apiVersion: v1
clusters:
- cluster:
certificate-authority-data: DELETED_CERT
server: https://some-domain-or-i:16443
name: my-cluster
contexts:
- context:
cluster: my-cluster
namespace: my-ns
user: oidc-user
name: my-cluster
current-context: my-cluster
kind: Config
users:
- name: oidc-user
user:
exec:
apiVersion: client.authentication.k8s.io/v1beta1
command: kubectl-oidc_login
args:
- get-token
- --oidc-issuer-url=
- --oidc-client-id=
- --oidc-extra-scope=openid
env: null
interactiveMode: IfAvailable
provideClusterInfo: false
Logging out OIDC:
kubectl oidc-login clean ;rm -rf ~/.kube/cache/oidc-login/By removing the cache a new login session will be foreced.
To access a cluster, use kubectl CLI. Both kubectl and helm use the same KUBECONFIG to access a cluster.
export KUBECONFIG=~/.kube/cluster-x/kubeconfig.yamlkubectl config set-context $(kubectl config current-context) --namespace=<your-ns>kubectl get namespaceskubectl get namespaces, or short kubectl get nskubectl -n <the-other-ns> get nssoftwaredam/gitlab-agent-example project, and we give the project itself also the rights:#file path: .gitlab/agents/cluster-x/config.yaml
ci_access:
projects:
- id: softwaredam/gitlab-agent-example
#path: .gitlab-ci.yml
talk-to-test-cluster:
stage: test
environment: my-test-cluster
script:
- kubectl config use-context softwaredam/gitlab-agent-example:my-test-cluster #
- kubectl get pods -n <my-namespace>