Curl minikube apiserver使用客户端证书进行身份验证

Question

有关使用curl和客户端证书和密钥向minikube api服务器进行身份验证的基本问题。

当我在api-server上curl /ping端点时，我得到一个403 (预期，身份验证失败)

curl -k https://127.0.0.1:32776/ping

{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "forbidden: User \"system:anonymous\" cannot get path \"/ping\"",
  "reason": "Forbidden",
  "details": {

  },
  "code": 403
}

为了解决这个问题，我尝试使用下面的curl命令

curl -v
--cert /Users/blah/.minikube/profiles/minikube/client.crt \
--cacert /Users/blah/.minikube/ca.cert \
--key /Users/blah/.minikube/profiles/minikube/client.key \
https://127.0.0.1:32776/ping

然后我就回来了

*   Trying 127.0.0.1:32776...
* Connected to 127.0.0.1 (127.0.0.1) port 32776 (#0)
* ALPN, offering http/1.1
* WARNING: SSL: CURLOPT_SSLKEY is ignored by Secure Transport. The private key must be in the Keychain.
* WARNING: SSL: Certificate type not set, assuming PKCS#12 format.
* SSL: Can't find the certificate "/Users/blah/.minikube/profiles/minikube/client.crt" and its private key in the Keychain.
* Closing connection 0
curl: (58) SSL: Can't find the certificate "/Users/blah/.minikube/profiles/minikube/client.crt" and its private key in the Keychain.

我使用的是kubectl config view中描述的上述证书

apiVersion: v1
clusters:
- cluster:
    certificate-authority: /Users/blah/.minikube/ca.crt
    server: https://127.0.0.1:32776
  name: minikube
contexts:
- context:
    cluster: minikube
    user: minikube
  name: minikube
current-context: minikube
kind: Config
preferences: {}
users:
- name: minikube
  user:
    client-certificate: /Users/blah/.minikube/profiles/minikube/client.crt
    client-key: /Users/blah/.minikube/profiles/minikube/client.key

我想这是我遗漏的更多关于curl用法的细节，minikube似乎还不错。另外，我很好奇其他人是如何认证对minikube的curl请求的？

Answer 1

你使用的是什么版本的curl？什么操作系统？不是MacOSX吗？

非常类似的问题Error when trying to access API via curl，也没有看到有效的当前证书。解决方案是将key转换为pkcs12。

How to access Kubernetes API using CURL帖子中的RaeesBhatti也建议

您必须使用$HOME/.minikube/目录中的证书，而不是$HOME/.minikube/certs中的证书。您还必须convert the certificates into P12格式，然后使用它们。