From 34140f10872eed1750e31f09ebd16b7e28bf5ea2 Mon Sep 17 00:00:00 2001 From: Fabrice Jammes Date: Fri, 20 May 2022 16:38:22 +0200 Subject: [PATCH 1/3] Update socks5-proxy-access-api.md MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If using `localhost` instead of , you get a certificate error: ``` kubectl get pods I0520 16:29:08.178277 41261 versioner.go:58] Get https://localhost:6443/version?timeout=5s: dial tcp 127.0.0.1:6443: connect: connection refused Unable to connect to the server: x509: certificate is valid for ccqserv225, kubernetes, kubernetes.default, kubernetes.default.svc, kubernetes.default.svc.cluster.local, not localhost ``` Please also note that I have a warning message if I unset the `https_proxy` env variable: ``` ⚙ kubectl get pods I0520 16:35:27.955076 43865 versioner.go:56] Remote kubernetes server unreachable NAME READY STATUS RESTARTS AGE hub-54c6457f66-vlq2l 1/1 Running 0 4h27m proxy-7b5b8dfb9d-dxrkz 1/1 Running 0 4h27m # Whereas with the https_proxy variable: ⚙ export https_proxy=socks5://localhost:1080 ⚙ kubectl get pods NAME READY STATUS RESTARTS AGE hub-54c6457f66-vlq2l 1/1 Running 0 4h28m proxy-7b5b8dfb9d-dxrkz 1/1 Running 0 4h28m ``` Any idea is welcome here. --- .../tasks/extend-kubernetes/socks5-proxy-access-api.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/en/docs/tasks/extend-kubernetes/socks5-proxy-access-api.md b/content/en/docs/tasks/extend-kubernetes/socks5-proxy-access-api.md index 698bc9c6b4..a785c5d91a 100644 --- a/content/en/docs/tasks/extend-kubernetes/socks5-proxy-access-api.md +++ b/content/en/docs/tasks/extend-kubernetes/socks5-proxy-access-api.md @@ -87,14 +87,14 @@ When you set the `https_proxy` variable, tools such as `curl` route HTTPS traffi you configured. For this to work, the tool must support SOCKS5 proxying. {{< note >}} -In the URL https://localhost/api, `localhost` does not refer to your local client computer. +In the URL https://localhost:6443/api, `localhost` does not refer to your local client computer. Instead, it refers to the endpoint on the remote server knows as `localhost`. The `curl` tool sends the hostname from the HTTPS URL over SOCKS, and the remote server resolves that locally (to an address that belongs to its loopback interface). {{}} ```shell -curl -k -v https://localhost/api +curl -k -v https://localhost:6443/api ``` To use the official Kubernetes client `kubectl` with a proxy, set the `proxy-url` element @@ -105,7 +105,7 @@ apiVersion: v1 clusters: - cluster: certificate-authority-data: LRMEMMW2 # shortened for readability - server: https://localhost # the "Kubernetes API" in the diagram above + server: https://:6443 # the "Kubernetes API" server, i.e. IP adress of kubernetes-remote-server.example proxy-url: socks5://localhost:1080 # the "SSH SOCKS5 proxy" in the diagram above (DNS resolution over socks is built-in) name: default contexts: @@ -142,4 +142,4 @@ Type `unset https_proxy` in a terminal to stop forwarding http traffic through t ## Further reading -* [OpenSSH remote login client](https://man.openbsd.org/ssh) \ No newline at end of file +* [OpenSSH remote login client](https://man.openbsd.org/ssh) From aba1766a83571e6be84be39480db8dba67fa53c9 Mon Sep 17 00:00:00 2001 From: Fabrice Jammes Date: Tue, 14 Jun 2022 22:55:22 +0200 Subject: [PATCH 2/3] Update content/en/docs/tasks/extend-kubernetes/socks5-proxy-access-api.md Co-authored-by: ZSC --- .../en/docs/tasks/extend-kubernetes/socks5-proxy-access-api.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/extend-kubernetes/socks5-proxy-access-api.md b/content/en/docs/tasks/extend-kubernetes/socks5-proxy-access-api.md index a785c5d91a..aa7c296676 100644 --- a/content/en/docs/tasks/extend-kubernetes/socks5-proxy-access-api.md +++ b/content/en/docs/tasks/extend-kubernetes/socks5-proxy-access-api.md @@ -105,7 +105,7 @@ apiVersion: v1 clusters: - cluster: certificate-authority-data: LRMEMMW2 # shortened for readability - server: https://:6443 # the "Kubernetes API" server, i.e. IP adress of kubernetes-remote-server.example + server: https://:6443 # the "Kubernetes API" server, in other words the IP address of kubernetes-remote-server.example proxy-url: socks5://localhost:1080 # the "SSH SOCKS5 proxy" in the diagram above (DNS resolution over socks is built-in) name: default contexts: From 1f22d45a3b81f9524f5ce3c6350f805bd1aed6a4 Mon Sep 17 00:00:00 2001 From: Fabrice Jammes Date: Tue, 14 Jun 2022 22:56:04 +0200 Subject: [PATCH 3/3] Update content/en/docs/tasks/extend-kubernetes/socks5-proxy-access-api.md Co-authored-by: ZSC --- .../en/docs/tasks/extend-kubernetes/socks5-proxy-access-api.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/tasks/extend-kubernetes/socks5-proxy-access-api.md b/content/en/docs/tasks/extend-kubernetes/socks5-proxy-access-api.md index aa7c296676..5dddd1119a 100644 --- a/content/en/docs/tasks/extend-kubernetes/socks5-proxy-access-api.md +++ b/content/en/docs/tasks/extend-kubernetes/socks5-proxy-access-api.md @@ -88,7 +88,7 @@ you configured. For this to work, the tool must support SOCKS5 proxying. {{< note >}} In the URL https://localhost:6443/api, `localhost` does not refer to your local client computer. -Instead, it refers to the endpoint on the remote server knows as `localhost`. +Instead, it refers to the endpoint on the remote server known as `localhost`. The `curl` tool sends the hostname from the HTTPS URL over SOCKS, and the remote server resolves that locally (to an address that belongs to its loopback interface). {{}}