Connect with your Kubernetes cluster Manually
Tags: kubernetes, k8s, cluster, shell
Published: 2020-04-06 08:07:23

---
title: Connect with your Kubernetes cluster Manually 
published: true
description: Documentation about connecting K8s cluster manually 
tags: kubernetes, K8s, cluster, shell
cover_image: https://bigstep.com/assets/images/blog/kubernetes-1.png
---

Howdy. I hope everyone going well recently and my city is in curfew so I utilize this period to make up some new skills. Kubernetes(K8s) is one of my favourite deployment platform. I spent my weekend to connect the cluster on the CI pipeline. 

## Prerequisites
Before we get our hands on, we'll need to setup some tools like register in GKE. Many other tools out there could do the same things as long as they support K8s. Feel free to use other options but make sure that adjust your setting while you're following with this post. 

## Compose Kube config file
Let's begin with setting up K8s cluster. Could skip this one if you already got yours.
```shell
gcloud container clusters create cluster-1 --zone europe-west3-a
```
Create a temporary folder to store **kube config** file and any other stuffs.
```shell
# environment variables
SERVICE_ACCOUNT_NAME=deployer
NAMESPACE=default
TARGET_FOLDER="/tmp/kube"
KUBECFG_FILE_NAME="${TARGET_FOLDER}/k8s-${SERVICE_ACCOUNT_NAME}-${NAMESPACE}-conf"

# create temp folder
mkdir -p "/tmp/kube"
```
Create service account and name it as deployer and better to restrict the permission which only need through.
```shell
kubectl create sa deployer --namespace default
kubectl create clusterrolebinding deployer --clusterrole cluster-admin --serviceaccount default:deployer
```
We want the secret which belongs to the service account and the secret bring us to acquire a certificate and a token. There commands help to do us a favour
```shell
SECRET_NAME=$(kubectl get sa deployer --namespace=default -o json | jq -r .secrets[].name)

# put the certificate into temp folder
kubectl get secret --namespace default "${SECRET_NAME}" -o json | jq \
    -r '.data["ca.crt"]' | base64 --decode  > "tmp/kube/ca.crt"

# extract and declare user token
USER_TOKEN=$(kubectl get secret --namespace default "${SECRET_NAME}" -o json | jq -r '.data["token"]' | base64 --decode)
```
Then we can set kube config file with the information above likes certificate, token etc. Eventually we should have a kube config file with corresponding value to allow our agent docker container connect to K8s.  
```shell
CONTEXT=$(kubectl config current-context)

CLUSTER_NAME=$(kubectl config get-contexts "${CONTEXT}" | awk '{print $3}' | tail -n 1)

ENDPOINT=$(kubectl config view \
    -o jsonpath="{.clusters[?(@.name == \"${CLUSTER_NAME}\")].cluster.server}")

# set cluster in kube config
kubectl config set-cluster "${CLUSTER_NAME}" \
    --kubeconfig="${KUBECFG_FILE_NAME}" \
    --server="${ENDPOINT}" \
    --certificate-authority="${TARGET_FOLDER}/ca.crt" \
    --embed-certs=true

# set token credentials in kube config 
kubectl config set-credentials \
    deployer-default-${CLUSTER_NAME}" \
    --kubeconfig=/tmp/kube/kube-conf \
    --token="${USER_TOKEN}"

# set context in kube config
kubectl config set-context \
    "deployer-default-${CLUSTER_NAME}" \
    --kubeconfig=/tmp/kube/kube-conf \
    --cluster="${CLUSTER_NAME}" \
    --user="deployer-default-${CLUSTER_NAME}" \
    --namespace=default

# use context with kube config
kubectl config use-context "deployer-default-${CLUSTER_NAME}" \
    --kubeconfig=/tmp/kube/kube-conf
```
Now the bullets are loaded and ready to roll. We can find the kube config file in this path: */tmp/kube/*. 
```yaml
# sample of kube config file
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: BASE64_CA_CERT
    server: https://YOUR_API_IP
  name: k8s
contexts:
- context:
    cluster: k8s
    user: k8s-deployer
  name: k8s
current-context: k8s
kind: Config
preferences: {}
users:
- name: k8s-deployer
  user:
    token: BASE64_TOKEN
```
Last but definitely not least, we have to grant the role based access control permission for service account and create the permissions-template.yaml
```yaml
# permissions-template.yaml
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1beta1
metadata:
  name: my_account-clusterrolebinding
subjects:
  - kind: ServiceAccount
    name: my_account
    namespace: my_namespace
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: ""
```
Time to apply the permission
```shell
# adjust the template and create the permission file for service account
sed -e "s|my_account|deployer|g" -e "s|my_namespace|default|g" \
    permissions-template.yaml > permissions_deployer.yaml     

# apply permission
kubectl apply -f permissions_deployer.yaml
```
Now we can simply use this kube config file on whichever instance it is and connect to our cluster. You could test the connectivity with this command
```shell
KUBECONFIG=/tmp/kube/kube-conf kubectl get pods
```

## Conclusion
Done. It's time to plug and play with our Kubernetes cluster. Stay connected. 😁