docs/doc/source/security/kubernetes/security-install-kubectl-and-helm-clients-directly-on-a-host.rst

Install Kubectl and Helm Clients Directly on a Host

You can use kubectl and helm to interact with a controller from a remote system.

Commands such as those that reference local files or commands that require a shell are more easily used from clients running directly on a remote workstation.

Complete the following steps to install kubectl and helm on a remote system.

The following procedure shows how to configure the kubectl and helm clients directly on remote host, for an admin user with cluster-admin clusterrole. If using a non-admin user such as one with only role privileges within a private namespace, the procedure is the same, however, additional configuration is required in order to use helm.

1. On the controller, if an admin-user service account is not already available, create one.

   1. Create the admin-user service account in kube-system namespace and bind the cluster-admin ClusterRoleBinding to this user.

      % cat <<EOF > admin-login.yaml
      apiVersion: v1
      kind: ServiceAccount
      metadata:
        name: admin-user
        namespace: kube-system
      ---
      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRoleBinding
      metadata:
        name: admin-user
      roleRef:
        apiGroup: rbac.authorization.k8s.io
        kind: ClusterRole
        name: cluster-admin
      subjects:
      - kind: ServiceAccount
        name: admin-user
        namespace: kube-system
      EOF
      % kubectl apply -f admin-login.yaml

   2. Retrieve the secret token.

      % kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep admin-user | awk '{print $1}')

2. On the workstation, install the kubectl client on an Ubuntu host by taking the following actions on the remote Ubuntu system.

   1. Install the kubectl client CLI.

      % sudo apt-get update
      % sudo apt-get install -y apt-transport-https
      % curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | \
      sudo apt-key add
      % echo "deb https://apt.kubernetes.io/ kubernetes-xenial main" | \
      sudo tee -a /etc/apt/sources.list.d/kubernetes.list
      % sudo apt-get update
      % sudo apt-get install -y kubectl

   2. Set up the local configuration and context.

      Note

      In order for your remote host to trust the certificate used by the K8S API, you must ensure that the k8s_root_ca_cert specified at install time is a trusted CA certificate by your host. Follow the instructions for adding a trusted CA certificate for the operating system distribution of your particular host.

      If you did not specify a k8s_root_ca_cert at install time, then specify –insecure-skip-tls-verify, as shown below.

      % kubectl config set-cluster mycluster --server=https://<oam-floating-IP>:6443 \
      --insecure-skip-tls-verify
      % kubectl config set-credentials admin-user@mycluster --token=$TOKEN_DATA
      % kubectl config set-context admin-user@mycluster --cluster=mycluster \
      --user admin-user@mycluster --namespace=default
      % kubectl config use-context admin-user@mycluster

      <$TOKEN_DATA> is the token retrieved in step 1.

   3. Test remote kubectl access.

      % kubectl get nodes -o wide
      NAME           STATUS   ROLES    AGE    VERSION   INTERNAL-IP       EXTERNAL-IP   OS-IMAGE ...
      controller-0   Ready    master   15h    v1.12.3   192.168.204.3     <none>        CentOS L ...
      controller-1   Ready    master   129m   v1.12.3   192.168.204.4     <none>        CentOS L ...
      worker-0       Ready    <none>   99m    v1.12.3   192.168.204.201   <none>        CentOS L ...
      worker-1       Ready    <none>   99m    v1.12.3   192.168.204.202   <none>        CentOS L ...
      %

3. On the workstation, install the helm client on an Ubuntu host by taking the following actions on the remote Ubuntu system.

   1. Install helm.

      % wget https://get.helm.sh/helm-v2.13.1-linux-amd64.tar.gz
      % tar xvf helm-v2.13.1-linux-amd64.tar.gz
      % sudo cp linux-amd64/helm /usr/local/bin

   2. Verify that helm installed correctly.

      % helm version
      Client: &version.Version{SemVer:"v2.13.1", GitCommit:"618447cbf203d147601b4b9bd7f8c37a5d39fbb4", GitTreeState:"clean"}
      Server: &version.Version{SemVer:"v2.13.1", GitCommit:"618447cbf203d147601b4b9bd7f8c37a5d39fbb4", GitTreeState:"clean"}

Configure Container-backed Remote CLIs and Clients <security-configure-container-backed-remote-clis-and-clients>

Configure Remote Helm Client for Non-Admin Users <configure-remote-helm-client-for-non-admin-users>