ISTIOCTL-CREATE-REMOTE-SECRET(1)

📦
version 1.31.3 · 2 versions
, in nixpkgs unstable

💅 istioctl-create-remote-secret — like, the manual page ✨

Okay bestie, so this is the istioctl-create-remote-secret page from the istioctl manual, and it's genuinely one of the more iconic little commands ngl 💖

🌸 NAME 🌸

istioctl-create-remote-secret — create a secret with credentials that let Istio access remote Kubernetes apiservers 🫶

🎀 SYNOPSIS 🎀

istioctl create-remote-secret [flags]

✨ DESCRIPTION ✨

Okay so, the whole vibe: this command creates a secret with credentials to allow Istio to access remote Kubernetes apiservers. That's the entire job. It makes the little handshake token so your Istio can go talk to a Kubernetes apiserver somewhere else. Lowkey essential for multi-cluster stuff, no cap 🔥

💅 OPTIONS 💅

  • --auth-plugin-config=[] — authenticator plug-in configuration 🧚. Heads up: --auth-type=plugin must be set alongside this option.
  • --auth-plugin-name="" — the authenticator plug-in name. Same deal: --auth-type=plugin must be set alongside this option.
  • --auth-type=bearer-token — which type of authentication to use. supported values = [bearer-token plugin].
  • --create-service-account[=true] — if true, the service account needed for creating the remote secret will be created if it doesn't already exist. so like, it'll spawn it for you instead of you having to go make it yourself 💁‍♀️
  • -h, --help[=false] — help for create-remote-secret. the classic.
  • -d, --manifests="" — specify a path to a directory of charts and profiles (e.g. ~/Downloads/istio-1.31.3/manifests). yes that exact path is the example, keep it 📁
  • --name="" — name of the local cluster whose credentials are stored in the secret. If a name isn't specified, the kube-system namespace's UUID of the local cluster will be used. so like, it'll auto-name your baby for you 🌈
  • --secret-name="" — the name of the specific secret to use from the service-account. Needed when there are multiple secrets in the service account. iykyk 🙈
  • --server="" — the address and port of the Kubernetes API server.
  • --service-account="" — create a secret with this service account's credentials. Default value is "istio-reader-service-account" if --type is "remote", and "istiod" if --type is "config". the way it just picks for you based on type, obsessed 👑
  • --tls-server-name="" — the server name that should be validated by kube-client during establishing TLS connection with kube-apiserver 🔐
  • --type=remote — type of the generated secret. supported values = [remote config].

🌈 OPTIONS INHERITED FROM PARENT COMMANDS 🌈

These ones come from the parent command, so they're just... already there for you. free real estate ✨

  • --as="" — username to impersonate for the operation. User could be a regular user or a service account in a namespace.
  • --as-group=[] — group to impersonate for the operation. This flag can be repeated to specify multiple groups. stack 'em 🫶
  • --as-uid="" — UID to impersonate for the operation.
  • --context="" — Kubernetes configuration context.
  • -i, --istioNamespace="istio-system" — Istio system namespace. default is istio-system, as it should be 💜
  • --kubeclient-timeout="15s" — Kubernetes client timeout as a time.Duration string, defaults to 15 seconds.
  • -c, --kubeconfig="" — Kubernetes configuration file.
  • -n, --namespace="" — Kubernetes namespace.
  • --vklog=0 — number for the log level verbosity. Like -v flag. ex: --vklog=9. go off with the verbosity if you want 🔍

🦋 EXAMPLE 🦋

# Create a secret to access cluster c0's apiserver and install it in cluster c1.
istioctl --kubeconfig=c0.yaml create-remote-secret --name c0 \
  | kubectl --kubeconfig=c1.yaml apply -f -

# Delete a secret that was previously installed in c1
istioctl --kubeconfig=c0.yaml create-remote-secret --name c0 \
  | kubectl --kubeconfig=c1.yaml delete -f -

# Create a secret access a remote cluster with an auth plugin
istioctl --kubeconfig=c0.yaml create-remote-secret --name c0 --auth-type=plugin --auth-plugin-name=gcp \
  | kubectl --kubeconfig=c1.yaml apply -f -

like, look at that pipe. the way it just flows into kubectl 😭💖 iconic behaviour.

⭐ SEE ALSO ⭐

  • istioctl(1) — the parent, the main character, the whole reason we're here 👑
ngl bestie, if you're doing multi-cluster Istio stuff, this is the one. read the flags, pick your --type, and let it cook 🔥

mwah 💋 this page was auto generated by spf13/cobra, and it's dated Jan 1980 — yes the date is silly, no I don't make the rules 🎀✨

📦 where this page comes from