From 19ac992525f229809f21e06ef83ff18641e31ecf Mon Sep 17 00:00:00 2001 From: John Torres Date: Thu, 11 Aug 2016 10:41:58 -0400 Subject: [PATCH 1/2] updated access to cluster/api w/o proxy post kube v1.3.2 --- docs/user-guide/accessing-the-cluster.md | 26 ++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/docs/user-guide/accessing-the-cluster.md b/docs/user-guide/accessing-the-cluster.md index cf15072373..7cfacf0176 100644 --- a/docs/user-guide/accessing-the-cluster.md +++ b/docs/user-guide/accessing-the-cluster.md @@ -69,7 +69,7 @@ $ curl http://localhost:8080/api/ } ``` -#### Without kubectl proxy +#### Without kubectl proxy (before v1.3.x) It is also possible to avoid using kubectl proxy by passing an authentication token directly to the apiserver, like this: @@ -85,7 +85,29 @@ $ curl $APISERVER/api --header "Authorization: Bearer $TOKEN" --insecure } ``` -The above example uses the `--insecure` flag. This leaves it subject to MITM +#### Without kubectl proxy (post v1.3.x) + +In recent versions of Kubernetes, `kubectl config view` no longer displays the token. Use `kubectl describe secret...` to get the token for the default service account, like this: + +``` shell +$ APISERVER=$(kubectl config view | grep server | cut -f 2- -d ":" | tr -d " ") +$ TOKEN=$(kubectl describe secret $(kubectl get secrets | grep default | cut -f1 -d ' ') | grep -E '^token' | cut -f2 -d':' | tr -d '\t') +$ curl $APISERVER/api --header "Authorization: Bearer $TOKEN" --insecure +{ + "kind": "APIVersions", + "versions": [ + "v1" + ], + "serverAddressByClientCIDRs": [ + { + "clientCIDR": "0.0.0.0/0", + "serverAddress": "10.0.1.149:443" + } + ] +} +``` + +The above examples use the `--insecure` flag. This leaves it subject to MITM attacks. When kubectl accesses the cluster it uses a stored root certificate and client certificates to access the server. (These are installed in the `~/.kube` directory). Since cluster certificates are typically self-signed, it From 6c4163fa64bf1b0efc2d8cbbfa39b9f3c39c45af Mon Sep 17 00:00:00 2001 From: John Torres Date: Sun, 11 Sep 2016 16:41:02 -0400 Subject: [PATCH 2/2] updates based on comments from @devin-donnelly --- docs/user-guide/accessing-the-cluster.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/user-guide/accessing-the-cluster.md b/docs/user-guide/accessing-the-cluster.md index 7cfacf0176..73289371e5 100644 --- a/docs/user-guide/accessing-the-cluster.md +++ b/docs/user-guide/accessing-the-cluster.md @@ -71,7 +71,7 @@ $ curl http://localhost:8080/api/ #### Without kubectl proxy (before v1.3.x) -It is also possible to avoid using kubectl proxy by passing an authentication token +It is possible to avoid using kubectl proxy by passing an authentication token directly to the apiserver, like this: ```shell @@ -87,7 +87,7 @@ $ curl $APISERVER/api --header "Authorization: Bearer $TOKEN" --insecure #### Without kubectl proxy (post v1.3.x) -In recent versions of Kubernetes, `kubectl config view` no longer displays the token. Use `kubectl describe secret...` to get the token for the default service account, like this: +In Kubernetes version 1.3 or later, `kubectl config view` no longer displays the token. Use `kubectl describe secret...` to get the token for the default service account, like this: ``` shell $ APISERVER=$(kubectl config view | grep server | cut -f 2- -d ":" | tr -d " ")