Accessing a Cluster Using an X.509 Certificate

Scenario

This section describes how to obtain the cluster certificate from the console and use it to access Kubernetes clusters.

Procedure

1. Log in to the CCE console and click the cluster name to access the cluster console.
2. On the Overview page, locate the Connection Info area, and click Download next to X.509 certificate.
   Figure 1 Downloading a cluster certificate
   

3. In the Obtain Certificate dialog box displayed, select the certificate expiration time and download the X.509 certificate of the cluster as prompted.
   

   • The downloaded certificate contains three files: client.key, client.crt, and ca.crt. Keep these files secure.
   • Certificates are not required for mutual access between containers in a cluster.

4. Call native Kubernetes APIs using the cluster certificate.

   For example, run the curl command to call an API to view the pod information. The following is an example:

   curl --cacert ./ca.crt --cert ./client.crt --key ./client.key  https://192.168.0.18:5443/api/v1/namespaces/default/pods/

   

   • ./ca.crt, ./client.crt, and ./client.key are the paths for uploading the client.key, client.crt, and ca.crt files, respectively.
   • 192.168.0.18:5443 is the private or public network address of the API server in the cluster.

   For more cluster APIs, see Kubernetes API.