Kubernetes。 HTTPS API返回“未经授权”

Question

Kubernetes API request curl https://192.168.0.139 --cacert /home/mongeo/ku-certs/ca.pem return Unauthorized

Request curl localhost:8080 worked good.

My kube-proxy and kube-apiserver standart ( coreos+k8s tutorial )

How do I get data on HTTPS?

Answer 1

Did you specify --token-auth-file=<file> and/or --basic-auth-file=<otherfile> or one of the other authentication modes? I don't know that https endpoint will work without one of these (maybe it should, but it doesn't, apparently). Check out https://kubernetes.io/docs/admin/authentication/

Answer 2

Hi this is what I did for token,

1. Find address Server Api - open /etc/kubernetes/kubelet.conf ——>example : server: https://10.1.32.120:6443
2. Find token, open /etc/kubernetes/pki/tokens.csv ———>example : 4c95a1a22d19b20811,kubeadm-node-csr,07ccbf35-e206-11e6-ab8f-0010184e550e,system:kubelet-bootstrap
3. In this case the token is —>4c95a1a22d19b20811
4. If use postman, add header —> Authorization: Bearer 4c95a1a22d19b20811

Answer 3

A simple way to access the Kubernetes API from an external network is to create an SSH tunnel , eg

ssh -L 9000:localhost:8080 roto@master.node

This will forward connection from your local port 9000 to localhost:8080 on your server.

As long as the SSH tunnel is open, you can query the API on port 9000 of your machine.

Answer 4

There are several ways to authenticate in the API. Simplest way for you to get authorized is to send Authentication header with "bearer TOKEN_VALUE" value. You can look at Kubernetes API configuration on your server to look up defined tokens. The header can be sent with http request using web browser extension.

Answer 5

finally, i figured this out:

lincai@pdbuddy:~/blackbox$ curl -v --cacert ./ca.pem --key ./admin-key.pem --cert ./admin.pem  https://xxxx/api/v1/
* Hostname was NOT found in DNS cache

> 
< HTTP/1.1 200 OK

Answer 6

curl https://192.168.0.139 —key ./admin-key.pem —cert ./admin.pem —cacert ./ca.pem