Kubernetes Host IP For Vault Authentication with Kubernetes Engine

Question

我正在尝试使用Hashicorps教程https://learn.hashicorp.com/vault/identity-access-management/vault-agent-k8s向外部存储库验证Kubernetes

在下面的配置中，我们必须在K8S_HOST中为群集提供END POINT

vault write auth/kubernetes/config \
        token_reviewer_jwt="$SA_JWT_TOKEN" \
        kubernetes_host="https://$K8S_HOST:8443" \
        kubernetes_ca_cert="$SA_CA_CRT"

我已经在私有子网设置了Kubernetes HA集群，在前端设置了ALB。我需要配置K8S_HOST端点的帮助。

到目前为止，我已经生成了SSL Certs并重新创建了仪表板。已尝试将kubernetes-dashboard公开为node port。已更新正在侦听443的ALB中的证书。但是它仍然没有连接到集群。

所以我怀疑K8S_HOST:8443是kubernetes仪表板还是其他东西的相同终点？

从私有子网中的群集获取K8S_HOST详细信息的正确方式。

有人能帮帮忙吗？我被这里打动了。

Answer 1

使用kubectl config view命令查看群集配置：

$ kubectl config view --flatten --minify
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUN5RENDQWJDZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwcmRXSmwKY201bGRHVnpNQjRYRFRJd01ETXdOakE0TlRFd05sb1hEVE13TURNd05EQTROVEV3Tmxvd0ZURVRNQkVHQTFVRQpBeE1LYTNWaVpYSnVaWFJsY3pDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTDRlClg5eWZpN0JhVVlUNmhUcEUvNm02WW5HczlZSHY3SmFMOGxsWWsvOENUVjBRcUk4VjBOYnB5V3ByQjBadmV4ZmMKQ0NTQ2hkYWFlcVBQWUJDckxTSGVoVllZcE1PK2UrMVFkTFN2RmpnZUQ1UHY0NFBqTW1MeFAzVkk0MFVZOXVNNwpCcjRueVRPYnJpWXJaSVhTYjdTbWRTdFg5TUgreVVXclNrRllGSEhnREVRdXF0dFRJZ1pjdUh2MzY3Nkpyc1FuCmI1TlM0ZHJyc0U0NVZUcWYrSXR1NzRSa1VkOUsvcTNHMHN1SlVMZ3AxOUZ4ZXorYTNRenJiUTdyWTlGUEhsSG4KVno1N1dWYmt2cjMzOUxnNWd0VzB4am10Q1hJaGgzNFRqRE1OazNza0VvcFBibjJPcER5STVUMUtOL3Vsa0FmTAptcXJ4bU5VNEVVYy9NcWFoVlVrQ0F3RUFBYU1qTUNFd0RnWURWUjBQQVFIL0JBUURBZ0trTUE4R0ExVWRFd0VCCi93UUZNQU1CQWY4d0RRWUpLb1pJaHZjTkFRRUxCUUFEZ2dFQkFBL3c0OEFkdFU3Tkx2d0k1S2N4Y3hMMitBT0IKV29nakFKNUMwTlBTN1NDR2tWK2d6dlcrZHZVYWVtYTFHUFlJdUJuajBVR2k2QUF5SStES0tiY01iL2dVVUdKQQp0YVpEcFpidU1lZ1JZOVZ2dlpMZXRZQndESzkvWk9lYnF1MGh6eWo4TzduTnJaM3RIb3h6VW1MaVVIU2Jmc0R1CnkvaE9IM0wvUE1mZ0FFaHF5SVZwWGMvQzZCYWNlOEtRSWJMQ0hYZmZjTGhEWDQ0THZYSXVIL1Y3LzN1cHcxWm8KK05NcFY5Sys4TTExNHV2bWdyOHdTNkZHYlltdXFVZy9CTlpRd2FqKzVWMEZ6azZzeHoySTdZSXI3NHVNK3BLRgpMS3lEQzJnK2NXTU5YZTV0S0YrVG5zUXE1eWtNVEJKeHl1bTh5a3VtZTE4MGcyS1o3NzVTdVF1Ni9kND0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=

    server: https://127.0.0.1:32769 # <<-----------here
  name: kind-kind
contexts:
- context:
    cluster: kind-kind
    user: kind-kind
  name: kind-kind
current-context: kind-kind
kind: Config
preferences: {}
users:
- name: kind-kind
... ... ...

配置Vault kubernetes身份验证方法时，复制server地址并将其用作kubernetes_host。

$ vault write auth/kubernetes/config \
           token_reviewer_jwt="eyJhbGciOiJSUz....." \
           kubernetes_host="https://127.0.0.1:32769" \
           kubernetes_ca_cert=@examples/guides/vault-server/ca.crt

N.B.:如果server地址不包含端口号，则无需添加它们。保持地址不变。

GKE的Demo服务器地址：

server: https://35.203.181.169

DigitalOcean k8s群集的演示服务器地址：

server: https://e8dabcb3-**bb-451e****d5.k8s.ondigitalocean.com

Answer 2

这个问题已经解决了。我必须将alb dns名称添加到api服务器证书中，然后重新启动所有节点。身份验证现在工作正常。