How to use generated credentials about dexter HOT 6 CLOSED

Hi Amet,

Your configuration looks pretty fine to me. Please have a look at the API server logs. I'm pretty sure there are some hints in there. My guess would be something like missing CA certificates.

Cheers!
Daniel

from dexter.

Thank you very much.
Yes, it was a problem with my apiserver.

from dexter.

Glad it works now. Do you mind sharing what caused the problem and how you fixed it? Will be helpful to others looking for help. Thanks!

from dexter.

Sure.
My APIServer config wasn't valid I guess:

    authorizationMode: RBAC
    authorizationRbacSuperUser: admin
    oidcCAFile: /srv/kubernetes/ca.crt
    oidcClientID: ${ID}
    oidcIssuerURL: https://accounts.google.com
    oidcUsernameClaim: email
    runtimeConfig:
      rbac.authorization.k8s.io/v1alpha1: "true"

I changed it on:

    oidcClientID: ${ID}
    oidcIssuerURL: https://accounts.google.com
    oidcUsernameClaim: email

from dexter.

So the CA seems to be the problem. This will have to be the CA for the certificate used by google in this case and not the internal CA. If you don't specify it the API will use the CA certificates installed in your OS. Thanks for sharing this

from dexter.

Yep. Thank you for help.
Could you advice me about minimal kubectl config, or how to bootstrap it?
We want to use dexter for creating creds for our developers, who have no any kubectl config.

from dexter.