Downloading kubectl

Download the kubectl of version 1.15 from the Kubernetes version release page.

Downloading cci-iam-authenticator

Download the cci-iam-authenticator binary file from the CCI official website. The latest version is v2.6.17.

Table 1 lists the addresses for downloading cci-iam-authenticator.

Installing and Configuring kubectl

Perform the following operations to install and configure kubectl on a Linux OS. For more details, see Install and Set Up kubectl.

1. Grant the execute permission on kubectl downloaded in Downloading kubectl and save it to the PATH directory.

   chmod +x ./kubectl

   mv ./kubectl $PATH

   In the preceding command, $PATH indicates the PATH directory (for example, /usr/local/bin). Replace it with the actual value.

   You can run the following command to view the kubectl version:

   kubectl version --client=true

   Client Version: version.Info{Major:"1", Minor:"15", GitVersion:"v1.15.0", GitCommit:"e8462b5b5dc2584fdcd18e6bcfe9f1e4d970a529", GitTreeState:"clean", BuildDate:"2019-06-19T16:40:16Z", GoVersion:"go1.12.5", Compiler:"gc", Platform:"linux/amd64"}

2. Configure IAM authentication information and persistently store it to the local host.
   1. Grant the execute permission on cci-iam-authenticator downloaded in Downloading cci-iam-authenticator and save it to the PATH directory.

      chmod +x ./cci-iam-authenticator

      mv ./cci-iam-authenticator $PATH

   2. Initialize the cci-iam-authenticator configuration.
      You can initialize the cci-iam-authenticator configuration by using either of the following methods:

      • Using AK/SK

        cci-iam-authenticator generate-kubeconfig --cci-endpoint=https://$endpoint --ak=xxxxxxx --sk=xxxxxx

        endpoint is an endpoint of CCI. For details about CCI endpoints, see Regions and Endpoints. For details on how to obtain the AK and SK, see Obtaining an AK/SK. ak is the access key in the file, and sk is the secret key in the file.

        For example, if endpoint is https://cci.cn-north-4.myhuaweicloud.com, ak is my-ak, and sk is ABCDEFAK.., run the following command:

        cci-iam-authenticator generate-kubeconfig --cci-endpoint=https://cci.cn-north-4.myhuaweicloud.com --ak=my-ak --sk=ABCDEFAK..

        Information similar to the following is displayed:

        Switched to context "cci-context-cn-north-4-my-ak"

        In the preceding command, cci-context-cn-north-4-my-ak is the context name, which can be viewed by running kubectl config get-contexts.

      • Using username and password

        cci-iam-authenticator generate-kubeconfig --cci-endpoint=https://$endpoint --domain-name=xxxxxxx --user-name=xxxxxx --password=xxxxxx

        In the preceding command, endpoint is the CCI endpoint, domain-name is the tenant name, user-name is the IAM username, and password is the IAM user password. Replace them with the actual values.

        

        • If there is no IAM user, set user-name to the same value as domain-name. Alternatively, do not set user-name.
        • For details about IAM endpoints, see Regions and Endpoints. Note that the IAM endpoint must be in the same region as the CCI endpoint.
        • If kubectl is used in an insecure environment, you are advised to configure environment variables to reconfigure the authentication information after this step is complete. For details, see Configuring kubectl in an Insecure Environment.

3. After the configuration is complete, you can run kubectl commands to perform operations on CCI resources.

   For example, run the following command to view the namespace resources in CN North-Beijing4:

   kubectl get ns

   No resources found.

   The command output shows that there is no namespace in CN North-Beijing4. Before creating resources in CCI, create a namespace by following the procedure described in Namespace and Network.

• When you access public cloud services through APIs, the username/password or AK/SK pair is required to encrypt the requests. This mechanism ensures the confidentiality and integrity of the requests as well as the correctness of the identities of both parties. Keep the $HOME/.kube/config configuration file secure to prevent unauthorized use of the AK/SK.
• If the function of caching tokens is enabled to improve access performance, the tokens are saved as files in the $HOME/.cci/cache directory. Delete the tokens in a timely manner when they are unnecessary.
• If your access key is used by an unauthorized person due to loss or leakage, you can delete the access key or notify the administrator of resetting it and then configure the access key again.
• Deleted access keys cannot be recovered.

Configuring kubectl in an Insecure Environment

1. Follow the preceding steps to install and configure kubectl.
2. Edit the kubeconfig file and delete sensitive information.
   On a Linux OS, the kubeconfig file is stored in $HOME/.kube/config by default.

   Table 2 Sensitive information to be deleted

   Command Flag	Environment Value	Description
   --domain-name	DOMAIN_NAME	Tenant name
   --user-name	USER_NAME	IAM user name
   --password	PASSWORD	User password
   --ak	ACCESS_KEY_ID	Access key ID
   --sk	SECRET_ACCESS_KEY	Secret access key
   --cache	CREDENTIAL_CACHE	Whether to cache tokens

   For details about more parameters, see cci-iam-authenticator Usage Reference.

3. Configure the environment variables corresponding to the deleted parameters. For example, configure AK, SK, and whether to cache tokens.

   export ACCESS_KEY_ID=xxxxxxx

   export SECRET_ACCESS_KEY=xxxxxxx

   export CREDENTIAL_CACHE=false

   kubectl get ns

   After the preceding commands are executed, information similar to the following is displayed:

   No resources found.

Obtaining an AK/SK

AK: access key ID. It is a unique ID associated with an SK. AK is used together with SK to sign requests.

SK: secret access key. It is used together with an AK to sign requests. They can identify request senders and prevent requests from being modified.

1. Log in to the management console.
2. Click the username and choose My Credentials from the drop-down list.
3. Choose Access Keys from the navigation pane.
4. Click Create Access Key, and enter the verification code.
5. Click OK to generate an access key and download it.
   

   Keep the AK/SK file confidential to prevent information leakage.

Obtaining CCI Endpoints

Endpoints are displayed on the Regions and Endpoints page.

cci-iam-authenticator Usage Reference

cci-iam-authenticator is the authentication add-on of the Kubernetes client and provides two subcommands generate-kubeconfig and token.

A tool to authenticate to CCI using HuaweiCloud IAM credentials

Usage:
  cci-iam-authenticator [command]

Available Commands:
  generate-kubeconfig Generate or modify kubeconfig files based on user configuration
  help                Help about any command
  token               Authenticate using HuaweiCloud IAM and get token for CCI

Flags:
      --alsologtostderr   log to standard error as well as files
  -h, --help              help for cci-iam-authenticator
      --log_dir string    If non-empty, write log files in this directory
      --log_file string   If non-empty, use this log file
      --logtostderr       log to standard error instead of files (default true)
  -v, --v Level           number for the log level verbosity
      --version           version for cci-iam-authenticator

Use "cci-iam-authenticator [command] --help" for more information about a command.

The Flags field lists log options.

token

The token command is used to obtain a user token. You can use either the username/password or AK/SK to obtain a token.

Authenticate using HuaweiCloud IAM and get token for CCI

Usage:
  cci-iam-authenticator token [flags]

Flags:
      --ak string                  IAM access key ID
      --cache                      Cache the token credential on disk until it expires (default true)
      --domain-name string         IAM domain name, typically your account name
  -h, --help                       help for token
      --iam-endpoint string        HuaweiCloud IAM endpoint, i.e. https://iam.cn-north-4.myhuaweicloud.com (default "https://iam.myhuaweicloud.com")
      --insecure-skip-tls-verify   If true, the iam server's certificate will not be checked for validity. (default true)
      --password string            IAM user password
      --project-id string          IAM project id, project id and project name should not be empty at same time
      --project-name string        IAM project name, project id and project name should not be empty at same time
      --sk string                  IAM secret access key
      --token-only                 Return token only for other tool integration
      --user-name string           IAM user name. Same as domain-name when using main account, otherwise use iam user name

The Flags field includes username, password, AK, SK, and common configurations.

generate-kubeconfig

This command is used to generate kubeconfig configurations. If the specified kubeconfig file already exists, new server, user, and context configurations will be injected and the newly injected context will be used for authentication. By default, the system verifies the user configuration and attempts to access IAM and CCI to ensure that the IAM authentication information is correct and the CCI address is available.

Generate or modify kubeconfig files based on user configuration.

Sets a cluster entry, a user entry and a context entry in kubeconfig and use this context as the current-context.

  The loading order follows these rules:

   1.  If the --kubeconfig flag is set, then only that file is loaded. The flag may only be set once and no merging takes
place.
   2.  If $KUBECONFIG environment variable is set, then it is used as a list of paths (normal path delimiting rules for
your system). These paths are merged. When a value is modified, it is modified in the file that defines the stanza. When
a value is created, it is created in the first file that exists. If no files in the chain exist, then it creates the
last file in the list.
   3.  Otherwise, ${HOME}/.kube/config is used and no merging takes place.

 Examples:
   # Generate kubeconfig to ${HOME}/.kube/config using aksk
   cci-iam-authenticator generate-kubeconfig --cci-endpoint=https://cci.cn-north-4.myhuaweicloud.com --ak=*** --sk=***
   # Generate kubeconfig to ${HOME}/.kube/config using domain name and password
   cci-iam-authenticator generate-kubeconfig --cci-endpoint=https://cci.cn-north-4.myhuaweicloud.com --domain-name=*** --password=***

Usage:
  cci-iam-authenticator generate-kubeconfig [flags]

Flags:
      --ak string                  IAM access key ID
      --cache                      Cache the token credential on disk until it expires (default true)
      --cci-endpoint string        CCI server endpoint, i.e. https://cci.cn-north-4.myhuaweicloud.com
      --domain-name string         IAM domain name, typically your account name
  -h, --help                       help for generate-kubeconfig
      --iam-endpoint string        HuaweiCloud IAM endpoint, i.e. https://iam.cn-north-4.myhuaweicloud.com (default "https://iam.myhuaweicloud.com")
      --insecure-skip-tls-verify   If true, the iam server's certificate will not be checked for validity. (default true)
      --kubeconfig string          use a particular kubeconfig file
      --password string            IAM user password
      --project-id string          IAM project id, project id and project name should not be empty at same time
      --project-name string        IAM project name, project id and project name should not be empty at same time
      --sk string                  IAM secret access key
      --token-only                 Return token only for other tool integration
      --user-name string           IAM user name. Same as domain-name when using main account, otherwise use iam user name
      --validation                 Validate kubeconfig by trying to access CCI with existing config (default true)

A kubeconfig file can contain multiple environment and authentication information records. You can use the same IAM authentication configuration and different cci-endpoint values to generate kubeconfig configurations for multiple regions. For example:

# Generate kubeconfig configuration for CN North-Beijing4 and switch to the corresponding context.
$ cci-iam-authenticator generate-kubeconfig --cci-endpoint=https://cci.cn-north-4.myhuaweicloud.com --ak=my-ak --sk=xxxxxx 
Switched to context "cci-context-cn-north-4-my-ak". 
# Generate kubeconfig configuration for CN East-Shanghai1 and switch to the corresponding context.
$ cci-iam-authenticator generate-kubeconfig --cci-endpoint=https://cci.cn-east-3.myhuaweicloud.com --ak=my-ak --sk=xxxxxx 
Switched to context "cci-context-cn-east-3-my-ak". 
# Switch to the context of CN North-Beijing4.
$ kubectl config use-context cci-context-cn-north-4-my-ak