docs/doc/source/security/kubernetes/configure-local-cli-access.rst

Configure Local CLI Access

You can access the system via a local CLI from the active controller/master node's local console or by SSH-ing to the OAM floating IP Address.

It is highly recommended that only 'sysadmin' and a small number of admin level user accounts be allowed to SSH to the system. This procedure will assume that only such an admin user is using the local CLI.

Using the sysadmin account and the Local CLI, you can perform all required system maintenance, administration and troubleshooting tasks.

1. Log in to controller-0 via the console or using SSH.

   Use the user name sysadmin and your <sysadmin-password>.

2. Acquire Keystone Admin and Kubernetes Admin credentials.

   $ source /etc/platform/openrc
   [sysadmin@controller-0 ~(keystone_admin)]$

3. If you plan on customizing the sysadmin's kubectl configuration on the Controller, (for example, kubectl config set-... or or oidc-auth), you should use a private KUBECONFIG file and NOT the system-managed KUBECONFIG file /etc/kubernetes/admin.conf, which can be changed and overwritten by the system.

4. Copy /etc/kubernetes/admin.conf to a private file under /home/sysadmin such as /home/sysadmin/.kube/config, and update /home/sysadmin/.profile to have the <KUBECONFIG> environment variable point to the private file.

   For example, the following commands set up a private KUBECONFIG file.

   # ssh sysadmin@<oamFloatingIpAddress>
   Password:
   % mkdir .kube
   % cp /etc/kubernetes/admin.conf .kube/config
   % echo "export KUBECONFIG=~/.kube/config" >> ~/.profile
   % exit

   Note

   The command

   echo "export KUBECONFIG=~/.kube/config" >> ~/.profile

   shown above is specific to CentOS. Substitute the correct syntax for your operating system. The following alternative is for Ubuntu:

   echo "export KUBECONFIG=~/.kube/config" >> ~/.bashrc

5. Confirm that the <KUBECONFIG> environment variable is set correctly and that kubectl commands are functioning properly.

   # ssh sysadmin@<oamFloatingIpAddress>
   Password:
   % env | fgrep KUBE
   KUBECONFIG=/home/sysadmin/.kube/config
   % kubectl get pods

You can now access all commands.

system commands

StarlingX system and host management commands are executed with the system command.

For example:

~(keystone_admin)]$ system host-list
+----+--------------+-------------+----------------+-------------+--------------+
| id | hostname     | personality | administrative | operational | availability |
+----+--------------+-------------+----------------+-------------+--------------+
| 1  | controller-0 | controller  | unlocked       | enabled     | available    |
+----+--------------+-------------+----------------+-------------+--------------+

Note

In the following examples, the prompt is shortened to:

~(keystone_admin)]$

Use system help for a full list of system subcommands.

fm commands

StarlingX fault management commands are executed with the fm command.

For example:

~(keystone_admin)]$ fm alarm-list

+-------+---------------+---------------------+----------+---------------+
| Alarm | Reason Text   | Entity ID           | Severity | Time Stamp    |
| ID    |               |                     |          |               |
+-------+---------------+---------------------+----------+---------------+
| 750.  | Application   | k8s_application=    | major    | 2019-08-08T20 |
| 002   | Apply Failure | platform-integ-apps |          | :17:58.223926 |
|       |               |                     |          |               |
+-------+---------------+---------------------+----------+---------------+

Use fm help for a full list of fm subcommands.

kubectl commands

Kubernetes commands are executed with the kubectl command

For example:

~(keystone_admin)]$ kubectl get nodes
NAME           STATUS   ROLES    AGE     VERSION
controller-0   Ready    master   5d19h   v1.13.5
~(keystone_admin)]$ kubectl get pods
NAME                                              READY   STATUS    RESTARTS   AGE
dashboard-kubernetes-dashboard-7749d97f95-bzp5w   1/1     Running   0          3d18h

Note

Use the remote Windows Active Directory server for authentication of local kubectl commands.