WEBVTT

00:00.250 --> 00:06.280
Okay, so let's go through the lab
on KubeConfig or security context.

00:07.420 --> 00:11.850
Where is the default kubeconfig file
located in the current environment?

00:11.980 --> 00:15.810
Find the current HOME directory by
looking at the HOME environment variable.

00:16.540 --> 00:18.210
Let's look at HOME,

00:18.210 --> 00:22.590
and HOME is set root
which is current directory we're in.

00:22.590 --> 00:27.840
We know that it's usually
under the hidden kube directory.

00:27.840 --> 00:31.730
We have our kube directory here,
and we have config here.

00:32.320 --> 00:37.760
If you look at this, you have .kube/config

00:38.030 --> 00:40.370
and that's really the kubeconfig file.

00:40.370 --> 00:44.040
It's at root.kube/config.

00:44.480 --> 00:48.730
root.kube/config.

00:49.410 --> 00:50.650
That's the one.

00:51.570 --> 00:55.160
Now how many clusters are defined
in the default kubeconfig file?

00:55.160 --> 00:57.310
If you look at this, in your clusters,

00:57.310 --> 01:02.290
you have one cluster,
and then you have context.

01:02.290 --> 01:04.250
So you just have one cluster.

01:04.570 --> 01:05.760
That's one.

01:07.780 --> 01:11.060
How many users are defined
in the default kubeconfig file?

01:11.060 --> 01:16.200
Here, see the users are just one again.

01:16.200 --> 01:17.250
Here you have the user,

01:17.250 --> 01:19.630
and you have
the certificate information here,

01:19.630 --> 01:21.530
so it's just one.

01:23.710 --> 01:27.420
How many contexts are defined
in the default kubeconfig file?

01:29.620 --> 01:34.210
If you look at the context, you have one.

01:34.740 --> 01:38.180
That's just one,
so you just have one context.

01:39.820 --> 01:43.240
Now, what is the user
configured in the current context?

01:43.240 --> 01:47.580
If you look at the current context,
it's kubernetes-admin@kubernetes.

01:47.680 --> 01:51.970
That's the name of the context,
and so that is this.

01:51.970 --> 01:53.550
This is that context.

01:53.550 --> 01:57.150
If you look at this,
the user is kubernetes-admin.

01:57.300 --> 01:59.540
Remember that this is just the name,

01:59.540 --> 02:03.860
so you shouldn't assume
that this is the actual user configured,

02:03.860 --> 02:05.730
but it so happens that in this case,

02:05.730 --> 02:09.730
the naming convention
is this user at the cluster,

02:09.730 --> 02:11.220
but you should always look at this field.

02:11.220 --> 02:15.810
This is the actual user
that's configured for that context.

02:15.900 --> 02:18.930
It is kubernetes-admin.

02:22.960 --> 02:27.380
What is the name of the cluster
configuring the default kubeconfig file?

02:27.500 --> 02:31.020
The name of the cluster,
so this is the cluster,

02:31.120 --> 02:33.170
and the name is kubernetes.

02:39.130 --> 02:44.140
Okay, so a new kubeconfig file
named my-kube-config is created,

02:44.360 --> 02:46.450
and it's in the root directory.

02:48.530 --> 02:50.430
Let's look at that.

02:52.190 --> 02:54.060
My-kube-config,

02:54.530 --> 02:56.610
and it is placed in the root directory,

02:56.610 --> 03:00.140
and how many clusters
are defined in that kubeconfig file.

03:00.140 --> 03:05.520
Let's look at this file, so you have
one, two, three, four, four clusters.

03:08.800 --> 03:12.610
How many contexts are configured
in the my-kube-config file?

03:12.740 --> 03:17.980
If you look at this, you have
one, two, three, four, four context.

03:20.800 --> 03:24.180
What user is configured
in the research context?

03:24.180 --> 03:26.500
If you look at the research context,

03:26.690 --> 03:29.920
you see that the user is dev-user,

03:29.920 --> 03:33.880
so that's dev-user, is that user.

03:34.770 --> 03:37.450
Now, what is the name
of the client certificate file

03:37.450 --> 03:39.960
configured for the aws-user?

03:39.960 --> 03:43.800
You have users here and you have aws-user,

03:44.010 --> 03:50.090
the client certificate file,
the file name is aws-user.crt,

03:50.090 --> 03:53.070
so that's aws-user.crt.

03:55.730 --> 04:00.890
What is the current context
set to in the my-kube-config file?

04:01.690 --> 04:04.320
The current context, as you can see here,

04:04.320 --> 04:09.820
it's test-user@development,
so that's the current context.

04:09.820 --> 04:11.950
That's test-user@development.

04:15.060 --> 04:21.250
Now, I would like to use the dev-user
to access test-cluster-1,

04:21.400 --> 04:24.290
and set the current context
to the right one,

04:24.290 --> 04:25.580
so I can do that.

04:25.580 --> 04:27.560
Once the right context is identified,

04:27.560 --> 04:30.780
use the kubectl config
use-context command.

04:30.780 --> 04:34.500
So dev-user to access test-cluster-1.

04:35.280 --> 04:39.950
We're going to look
at context and dev-user.

04:40.090 --> 04:41.680
This is the dev-user,

04:41.680 --> 04:45.890
and to access test-cluster-1,
there's already a context called research,

04:45.890 --> 04:47.870
so we're going to use that.

04:49.580 --> 04:53.000
What we need to do
is use the kubectl config command,

04:53.000 --> 04:56.690
so kubectl config command

04:56.900 --> 05:01.280
and use for use-context command,

05:01.280 --> 05:06.170
and the context
that we're going to use is research.

05:06.260 --> 05:10.910
Now remember that by default,
the kubectl config command

05:10.910 --> 05:17.180
will use the default kubeconfig file
which is in root.kube/config.

05:17.180 --> 05:21.630
This is in a different file
that we want it to work on

05:21.630 --> 05:27.000
so we have to provide
this file name like this.

05:29.080 --> 05:32.850
Okay, so I switched to context research.

05:33.210 --> 05:35.400
Let's check it out.

05:35.400 --> 05:40.240
We see that the current context
within the file is set to research.

05:40.690 --> 05:43.340
Okay, let's check the work.

05:45.550 --> 05:49.950
Now, we don't want to have to specify
the kubeconfig file option on each command

05:49.950 --> 05:53.840
to make the main cube config,
file the default kubeconfig file.

05:55.880 --> 05:57.320
This is what we want to use going forward.

05:57.320 --> 05:58.860
What we're going to do is

05:58.860 --> 06:04.260
we're going to move this kubeconfig file

06:05.570 --> 06:10.330
as a default one, which is available here.

06:11.280 --> 06:16.040
Let's make sure that move is complete.

06:16.590 --> 06:17.720
Yes.

06:19.500 --> 06:21.720
Going forward, we don't have to do

06:21.720 --> 06:27.930
a kubectl config view.

06:28.400 --> 06:31.720
We can see that this is the new view.

06:32.200 --> 06:33.770
Yes, check it.

06:36.190 --> 06:37.860
This is the new file.

06:38.220 --> 06:41.800
Now, with the current context
set to research,

06:41.800 --> 06:45.000
we are trying to access the cluster,
however, something seems to be wrong,

06:45.000 --> 06:46.740
identify and fix the issue.

06:49.120 --> 06:52.410
Let's do a kubectl get nodes command,

06:52.570 --> 06:53.980
we see that there's something wrong.

06:53.980 --> 06:56.340
It says unable to read client-cert

06:56.680 --> 07:01.420
/etc/kubernetes/pki/user
/dev-user/developer-user.crt

07:01.420 --> 07:02.680
for the dev-user.

07:03.790 --> 07:07.470
Let's check the contents of the file.

07:09.410 --> 07:13.420
We see that the dev user

07:13.640 --> 07:15.530
has client certificate,

07:15.800 --> 07:18.910
which is set to
dev-user/developer-user.crt.

07:19.080 --> 07:22.610
Now, all user certificates
are stored in this directory.

07:22.610 --> 07:24.570
Let's go here.

07:24.570 --> 07:26.670
We have the dev user.

07:26.980 --> 07:28.030
Let's go here.

07:28.030 --> 07:33.230
We see that it's dev-user.crt,
dev-user.csr, dev-user.key.

07:33.230 --> 07:37.460
It's dev-user.crt, not developer user.crt.

07:37.460 --> 07:39.890
We're going to have to modify that.

07:41.070 --> 07:42.690
Let's go in

07:44.980 --> 07:50.370
and let's change this,

07:52.910 --> 07:54.250
so that's fixed.

07:55.570 --> 07:57.160
Let's try it again.

07:58.320 --> 08:00.290
Yes, that seems to be working.

08:03.040 --> 08:06.890
Okay, so that is the end of this lab.