exo(1)

exo(1) — SKS kubeconfig glow-up 💅✨

NAME 🎀

exo-compute-sks-kubeconfig — Generate a Kubernetes kubeconfig file for an SKS cluster

SYNOPSIS 🧚

exo compute sks kubeconfig CLUSTER-NAME|ID USER [flags]

DESCRIPTION 🌸

Okay so this command generates a kubeconfig file that you use to authenticate to an SKS cluster API. Main character energy for your cluster access 💖

The user command argument is literally the CN field of the generated X.509 client certificate. Optionally, you can specify client certificate groups using the -g|--group option: those groups will be set in the "O" field of the certificate. See 1 (https://kubernetes.io/docs/reference/access-authn-authz/authentication/#x509-client-certs) for more information about Kubernetes authentication certificates.

Example usage:

# Obtain "cluster-admin" credentials
$ exo compute sks kubeconfig my-cluster admin \
      --zone de-fra-1 \
    -g system:masters \
    -t $((86400 * 7)) > $HOME/.kube/my-cluster.config
$ kubeconfig --kubeconfig=$HOME/.kube/my-cluster.config get pods

Note: if no TTL value is specified, the API applies a default value as a safety measure. Please look up the API documentation for more information. No cap, go check it 👑

Using exo CLI as Kubernetes credential plugin ✨

If you wish to avoid leaving sensitive credentials on your system, you can use exo CLI as a Kubernetes client-go credential plugin2 (https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins) to generate and return a kubeconfig dynamically when invoked by kubectl without storing it on disk. Iconic, honestly 🦋

To achieve this configuration, edit your kubeconfig file so that the "users" section relating to your cluster ("my-sks-cluster" in the following example) looks like:

apiVersion: v1
kind: Config
clusters:
- name: my-sks-cluster
  cluster:
    certificate-authority-data: **BASE64-ENCODED CLUSTER CERTIFICATE**
    server: https://153fcc53-1197-46ae-a8e0-ccf6d09efcb0.sks-ch-gva-2.exo.io:443
users:
- name: exo@my-sks-cluster
  user:
    # The "exec" section replaces "client-certificate-data"/"client-key-data"
    exec:
      apiVersion: "client.authentication.k8s.io/v1beta1"
      command: exo
      args:
      - sks
      - kubeconfig
      - my-sks-cluster
      - --zone=ch-gva-2
      - --exec-credential
      - user
contexts:
- name: my-sks-cluster
  context:
    cluster: my-sks-cluster
    user: exo@my-sks-cluster
current-context: my-sks-cluster

Notes 📝

• The exo CLI binary must be installed in a directory listed in your PATH shell environment variable.
• You can specify the "--group" flag in the user.exec.args section referencing a non-admin group to restrict the privileges of the operator using kubectl.

OPTIONS 💅

• -x, --exec-credential[=false] — output an ExecCredential object to use with a kubeconfig user.exec mode
• -g, --group=[] — client certificate group. Can be specified multiple times. Defaults to system:masters
• -h, --help[=false] — help for kubeconfig
• -t, --ttl=0 — client certificate validity duration in seconds
• -z, --zone="" — SKS cluster zone

OPTIONS INHERITED FROM PARENT COMMANDS 👑

• -C, --config="" — Specify an alternate config file [env EXOSCALE_CONFIG]
• -O, --output-format="" — Output format (table|json|text), see exo output --help for more information
• --output-template="" — Template to use if output format is "text"
• -Q, --quiet[=false] — Quiet mode (disable non-essential command output)
• --timeout=15s — Per-zone timeout for list operations; -1s disables timeout [env EXOSCALE_TIMEOUT]
• -A, --use-account="" — Account to use in config file [env EXOSCALE_ACCOUNT]

SEE ALSO 🔗

exo-compute-sks(1) — go peek, bestie 💖

HISTORY 📜

1-Jan-1980 Auto generated by spf13/cobra

---

Auto generated by spf13/cobra · Jan 1980 · exo(1) — that's the whole vibe, ily bestie! 💖