Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

example: use ServiceAccount for k8s cluster authentication#1096

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
bpmct merged 1 commit intokubesamplefrombpmct/kubesample-serviceaccount
May 11, 2022
Merged
Show file tree
Hide file tree
Changes fromall commits
Commits
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
72 changes: 72 additions & 0 deletionsexamples/kubernetes-multi-service/README.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -3,3 +3,75 @@ name: Develop multiple services in Kubernetes
description: Get started with Kubernetes development.
tags: [cloud, kubernetes]
---

# Authentication

This template has several ways to authenticate to a Kubernetes cluster.

## kubeconfig (Coder host)

If the Coder host has a local `~/.kube/config`, this can be used to authenticate with Coder. Make sure this is on the same user running the `coder` service.

## ServiceAccount

Create a ServiceAccount and role on your cluster to authenticate your template with Coder.

1. Run the following command on a device with Kubernetes context:

```sh
CODER_NAMESPACE=default
kubectl apply -n $CODER_NAMESPACE -f - <<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
name: coder
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: coder
rules:
- apiGroups: ["", "apps", "networking.k8s.io"] # "" indicates the core API group
resources: ["persistentvolumeclaims", "pods", "deployments", "services", "secrets", "pods/exec","pods/log", "events", "networkpolicies", "serviceaccounts"]
verbs: ["create", "get", "list", "watch", "update", "patch", "delete", "deletecollection"]
- apiGroups: ["metrics.k8s.io", "storage.k8s.io"]
resources: ["pods", "storageclasses"]
verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: coder
subjects:
- kind: ServiceAccount
name: coder
roleRef:
kind: Role
name: coder
apiGroup: rbac.authorization.k8s.io
EOF
```

1. Use the following commands to fetch the values:

**Cluster IP:**

```sh
kubectl cluster-info | grep "control plane"
```

**CA certificate**

```sh
kubectl get secrets -n $CODER_NAMESPACE -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='coder')].data['ca\.crt']}{'\n'}"
```

**Token**

```sh
kubectl get secrets -n $CODER_NAMESPACE -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='coder')].data['token']}{'\n'}"
```

**Namespace**

This should be the same as `$CODER_NAMESPACE`, set in step 1.
56 changes: 55 additions & 1 deletionexamples/kubernetes-multi-service/main.tf
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -11,8 +11,62 @@ terraform {
}
}

variable "step1_use_kubeconfig" {
type = bool
sensitive = true
description = "Use local ~/.kube/config? (true/false)"
}

variable "step2_cluster_host" {
type = string
sensitive = true
description = <<-EOF
Hint: You can use:
$ kubectl cluster-info | grep "control plane"


Leave blank if using ~/.kube/config (from step 1)
EOF
}

variable "step3_certificate" {
type = string
sensitive = true
description = <<-EOF
Use docs at https://github.com/coder/coder/tree/main/examples/kubernetes-multi-service#serviceaccount to create a ServiceAccount for Coder and grab values.
Copy link
MemberAuthor

@bpmctbpmctApr 20, 2022•
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others.Learn more.

I had to link to the README because Terraform will force indent any text here and <<-EOF wasn't working with the double-spaced YAML to create a ServiceAccount on a cluster


Enter CA certificate

Leave blank if using ~/.kube/config (from step 1)
EOF
}

variable "step4_token" {
type = string
sensitive = true
description = <<-EOF
Enter token (refer to docs at https://github.com/coder/coder/tree/main/examples/kubernetes-multi-service#serviceaccount)

Leave blank if using ~/.kube/config (from step 1)
EOF
}

variable "step5_coder_namespace" {
type = string
sensitive = true
description = <<-EOF
Enter namespace (refer to docs at https://github.com/coder/coder/tree/main/examples/kubernetes-multi-service#serviceaccount)

Leave blank if using ~/.kube/config (from step 1)
EOF
}

provider "kubernetes" {
config_path = "~/.kube/config"
# Authenticate via ~/.kube/config or a Coder-specific ServiceAccount, depending on admin preferences
config_path = var.step1_use_kubeconfig == true ? "~/.kube/config" : null
host = var.step1_use_kubeconfig == false ? var.step2_cluster_host : null
cluster_ca_certificate = var.step1_use_kubeconfig == false ? base64decode(var.step3_certificate) : null
token = var.step1_use_kubeconfig == false ? base64decode(var.step4_token) : null
}

data "coder_workspace" "me" {}
Expand Down
[8]ページ先頭
©2009-2025 Movatter.jp