Category: Kubernetes Security

bookmark_borderKubeConfig in Kubernetes

Posted on by Jay Jo

Use kubeconfig files to organize information about clusters, users, namespaces, and authentication mechanisms. The kubectl command-line tool uses kubeconfig files to find the information it needs to choose a cluster and communicate with the API server of a cluster.

https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/#:~:text=The%20kubectl%20command%2Dline%20tool,of%20referring%20to%20configuration%20files.

By default, kubectl looks for a file named config in the $HOME/.kube directory. You can specify other kubeconfig files by setting the KUBECONFIG environment variable or by setting the --kubeconfig flag.

$ kubectl config view
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: DATA+OMITTED
    server: https://192.168.56.2:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    namespace: production
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED

$ cat /home/vagrant/.kube/ config
apiVersion: v1
clusters:
- cluster:
    certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM1ekNDQWMrZ0F3SUJBZ0lCQURBTkJna3Foa2lHOXcwQkFRc0ZBREFWTVJNd0VRWURWUVFERXdwcmRXSmwKY201bGRHVnpNQjRYRFRJd01URXlNakEzTWpFMU0xb1hEVE13TVRFeU1EQTNNakUxTTFvd0ZURVRNQkVHQTFVRQpBeE1LYTNWaVpYSnVaWFJsY3pDQ0FTSXdEUVlKS29aSWh2Y05BUUVCQlFBRGdnRVBBRENDQVFvQ2dnRUJBTXBKCndJUS9vZjJPMnh2dnY5NTZqcjRvRVdmRW5QNW9oNGFBeG5YNlN4Z2FPa2lBR3IrdWJ2STBXcURsaWFhVm1aeUQKUGpBbk1NUnRqZFlsVWp6bURTWkpvOTNBN04vdExiRmZKTXJwekY1KzJVQnp2d29IUUp2SUF1QVpGQVdSSlM2NgpFbm5vL2V5djE4RmNFd1pvaGk2clJtTzIzaGpNNmk3akY0TDhJQisvcE9tVmZjdWI1YTdkcWpLdVFGN2VmYjFoCk1nYTd1ejNQaFRjZktGQWswSWZ6WHU1VTkwVnhqdTNpeW5rOXp3aDZwSXBudS9vK3N6K1gvODlvNGVYQjBEQ04KRDV6azhwSjVIVTNvOXQxS0NsVWdaS0grSkVVR2V3dlo2RVBNVHVOVVZ1a3pDVGJFM2wxY1VFSnlWQ2N5b0tTaApUcVMycFpKc0R2V0ZLYzZYMWI4Q0F3RUFBYU5DTUVBd0RnWURWUjBQQVFIL0JBUURBZ0trTUE4R0ExVWRFd0VCCi93UUZNQU1CQWY4d0hRWURWUjBPQkJZRUZCbnlQUFdyem8wNGhpMFZzczgxWFhjWFJDT2xNQTBHQ1NxR1NJYjMKRFFFQkN3VUFBNElCQVFBRzBXSzA5b05XSzNDVlZBY3k0dnpybms5dTBPa0J5bzNKcUNHbmxESW5tTWl4alJIVQpLUnJqNmMrWmM3Sll5b1k0NE1rZ1FhQXVkTG8ybU9veGcwSWdDeWFHai8wczZPOHZ6K3hjNmxwcG12YmRpVGNpClNqNC9OWWNJU0ZvcTh2R0JCVzE2R3MrTjVFRE1hVFdkMUJQNUpyV21MSUNHUG53aUtoSjFJbnFNbTh3YUczaHoKTWpheG1OR2w1RFk1Nk45eTFvU0IrN1h0WWJSM2RRdmc4bjBBd0VoZmVsZ2pYU1dGR0NlMGtueGlQb2NLcTEyagpweFlVb3BZU1dUaHJGVWdTY2srcmcxOHV1Uys4L1NyeUErT3NMakN0a2J0ZzBzd2c2b1krOGpFcTNjamFrWHRjCmRjMW1tRHpSR1MxM3RzRGZmclNIdzhDdlNYR1B0QldOd1JMdQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg==
    server: https://192.168.56.2:6443
  name: kubernetes
contexts:
- context:
    cluster: kubernetes
    namespace: production
    user: kubernetes-admin
  name: kubernetes-admin@kubernetes
current-context: kubernetes-admin@kubernetes
kind: Config
preferences: {}
users:
- name: kubernetes-admin
  user:
    client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURFekNDQWZ1Z0F3SUJBZ0lJSzNra2ZrMW81YjR3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TURFeE1qSXdOekl4TlROYUZ3MHlNVEV4TWpJd056SXhOVFZhTURReApGekFWQmdOVkJBb1REbk41YzNSbGJUcHRZWE4wWlhKek1Sa3dGd1lEVlFRREV4QnJkV0psY201bGRHVnpMV0ZrCmJXbHVNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXlkaW0waEFYM2dmeVR5Q1kKV1pQSXhaMHVSR0RYTTNqUzEyd0N6QlRRc1BWTnFJa1ZmRWZWUVUrcUJDdWREcjhLR1RlK2hjL0RySVlpR0hNbwpDQ2N4Ni9YS1pKakhSNlpvTjFMWWQ3RmxScStFQTlwc2FQbUFnWDRpZ1p1ZURURGk5QjR3UHVyWGdiNTVjVXdLClZUR2ZOdW5va2JXcXhrNVBUZ0J2YmlRUDg1UjVrNzlWdGtnRjdxMFFxaHRHV3A2Q3N3blhVN3hLc3FNeGpmRFYKU09WWEwzWVJ3c3NOZE1mL2FyWGt2TFNqK1VKb3M4Q0tHWHozSm5sTGVrbzNUYnB5QkF0amtIbkNsSk1DaHhBbApDZ0p0TWNkd0tlVGdLSmlER2REVllIa05Qekpzd3IyMWZCbWJ0V2FTNk9OaVpXUXFob0wvWi9VWHpYWnAxTytQCm9MSTFiUUlEQVFBQm8wZ3dSakFPQmdOVkhROEJBZjhFQkFNQ0JhQXdFd1lEVlIwbEJBd3dDZ1lJS3dZQkJRVUgKQXdJd0h3WURWUjBqQkJnd0ZvQVVHZkk4OWF2T2pUaUdMUld5enpWZGR4ZEVJNlV3RFFZSktvWklodmNOQVFFTApCUUFEZ2dFQkFCWFlDOWt2bWVMWUVYdzNaR3Q3QWcvRU5VblAvSGJFSkVnMXRXVnZlci8wUis1V2Y3cWpHbkNlCjlSdktRMi9KRWVzZzZmVmRYY3ZjVVN0WXVod3BHa0c4NG5ZRnJydWh5NmVWcW9JTy9yOVJoN3BlVUdPWEE5eFgKSnJ6bEN2VVoxT2I1Y0lUNlhSKzZGcXJ1R0lnVExHUllselNuc1FDQWwxZGd0eDJnN0RhMSs3MVV0RE5mWWdJSQpFNnBUaEpnOGNZMFZPQWRwNWV2aytYbGFBaHpDVHBuVFB0SmxxbXZZM28rK1hBbkdpb2I5dkZMZXZ2OVo5WWpZClhvMm5uMnY5blBRQjJua0ZodjhuOXFoRk1KYXU0ejN2OVRWRk5uckhyMVh5YW53U0VFUnNUenF1WmdNbDRoa00KcFlrSEJvcjRsZGpRN0t3Q00zVjUrbmVZUlZTMzgyaz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
    client-key-data: LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlFb3dJQkFBS0NBUUVBeWRpbTBoQVgzZ2Z5VHlDWVdaUEl4WjB1UkdEWE0zalMxMndDekJUUXNQVk5xSWtWCmZFZlZRVStxQkN1ZERyOEtHVGUraGMvRHJJWWlHSE1vQ0NjeDYvWEtaSmpIUjZab04xTFlkN0ZsUnErRUE5cHMKYVBtQWdYNGlnWnVlRFREaTlCNHdQdXJYZ2I1NWNVd0tWVEdmTnVub2tiV3F4azVQVGdCdmJpUVA4NVI1azc5Vgp0a2dGN3EwUXFodEdXcDZDc3duWFU3eEtzcU14amZEVlNPVlhMM1lSd3NzTmRNZi9hclhrdkxTaitVSm9zOENLCkdYejNKbmxMZWtvM1RicHlCQXRqa0huQ2xKTUNoeEFsQ2dKdE1jZHdLZVRnS0ppREdkRFZZSGtOUHpKc3dyMjEKZkJtYnRXYVM2T05pWldRcWhvTC9aL1VYelhacDFPK1BvTEkxYlFJREFRQUJBb0lCQUN0TTBjU2dkUzVKVUI3UApaRDliSjZmVTV6YjkrMHhzYi9hTWtqRUxpaFZjR2pPOGJLS0RtbWp2V1E2WitKQlFSUzlSdVFwbG5wbGxFTzFqCnpzT28vTm1jbWJWbzNOOHZBSTVWdEdCQTZ2UDE5UUVLbTFVTnFSYWVZM0tnV3BDRDJ6djVPZXBWWUxQUms2WE4KWlM0UGZoTStySWlOaXp3TlVvL3VJZmxqdlJSSWRPVEFXaURsS3ZRUjc3SVZKU2MyYUZibzl2VllvNTV0VEZqVgpyTEtKbVV0aE5TVURGU2xoLzNDeGhOTjhZaGlzYWNOb05xQVJDQkJNWWZjdGNOb3NJRVcvclcwSURhN21Qb2pkCmhwa0tDOHRpMzNFMUV2L21TTHBFSU0yUEVORktHd3A3djZ2ejVGdnVNbmgzRHlMY2orZGN6RDYyMnB6U0RmRnoKWTk5S1FwVUNnWUVBMUJXd1RwTFlZblM3UllZSHdQYnRBMWFpaVdBVXMrSXV0ZTBTd0hNNURTekRKOGN5T1JsMwppSWp5V0FIdnYwcjFZYUJhQTFBUGZ4ZFFyV3FsODN0ajNvdlVQclZHSmVUdGErTFVMVzBBTVhBVmsyYm1vUUNqCjNjVG9oUDNiODR3YnBLWTNjZVA2dS9lUUlWNURDaGkyalZmVnlya2JjQ1JOeURlaDdOMGdoVHNDZ1lFQTg2UTkKQzAzRVBZQnlkbUMzRFRRanRsMU85aVIyUjZQMEt4c2FuZFhMaWV5b0tVRkhVcTZlRXdMakFXQk5tSDVVUkZEYgpNTnFEamRsdkhpYXJLbVFIVW82UENSZkdMbW5WdmtmTjdBV3BoYmF2TlB1VHhtbXZWTDgyejhmcG9EaVVsTnhTCnpYcGdCU0M0Y2k5YWNxcmxuR0hzRFZlZ25sTlQ0Y1lSTFJYTVpYY0NnWUJhV3Zjbk1wYXZzNDNKZStXM3h6dUkKN1pNSHRnQjc5c1B4ekJQdUcralZmUm1UeStEUXhOSFJRSThIQWFRenVtcTZjZ2VIVzhlT1hNK0pZbU5iVFZscQpDZWFkNUxzREQvbzZ1WU90NnI5blVKcFFsMGx3bElZN3lGVkx1NS9HcmcxazQwL0IzT0FJenRyLzdGbmhaay8zCi9kRGVzbWhIS2FCZHlaM1ovUWVLMndLQmdRRFhSNlA0dlBwTkxaWDJLM2NUWDZLK25Ld01xaU1wSWlHNWhQVjcKeVZGVHlaeTg5MFZDTmJEUE01bkp1WUpXNENrdFJCU3BraXJ6eDlCN1g4ZVdhVlJmQ2tBdzFLVDBsZWViZm03aAp3ZzhNYTJOYytYNlZyd1NSYVhQUkhOKytCc0NpMkJzQ0hNT0RSR28xMnNtYzBJeWFKWndpSGU5NmRqNkVIRE5KCkZ4M0grUUtCZ0RqMnp5Mkt1bWtMVUQ1Sm9uSm5kWHVXWms1RHhieU5tMDUwVkd5V2lGQVJFb2M2UFdQaVJvVkwKTnR5VEJRWUJnRElOWTcrTWsvNjdyMFQ2QVRYSUZXWXZaTitJb0d6dzF5TkxZQ0M1RkYzYk9TeVhJODZ2Z2lOZwpPeUROZCs5N0VYa2RlWFgwL0JxclMvOU5DSlVPdHNRK1QvVUFScEFPRGlIQ245L29leWJXCi0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg==

apiVersion: v1
clusters:
- name: develpoment
- name: production
contexts:
- name: custom-admin@custom-kube
- name: prod@production
current-context: custom-admin@custom-kube
kind: Config
preferences: {}
users:
- name: developer
- name: admin

if you move the custom config to config home directory this becomes our default config file.

More command

$ kubectl config -h
Modify kubeconfig files using subcommands like "kubectl config set current-context my-context"

 The loading order follows these rules:

  1.  If the --kubeconfig flag is set, then only that file is loaded. The flag may only be set once
and no merging takes place.
  2.  If $KUBECONFIG environment variable is set, then it is used as a list of paths (normal path
delimiting rules for your system). These paths are merged. When a value is modified, it is modified
in the file that defines the stanza. When a value is created, it is created in the first file that
exists. If no files in the chain exist, then it creates the last file in the list.
  3.  Otherwise, ${HOME}/.kube/config is used and no merging takes place.

Available Commands:
  current-context Displays the current-context
  delete-cluster  Delete the specified cluster from the kubeconfig
  delete-context  Delete the specified context from the kubeconfig
  get-clusters    Display clusters defined in the kubeconfig
  get-contexts    Describe one or many contexts
  rename-context  Renames a context from the kubeconfig file.
  set             Sets an individual value in a kubeconfig file
  set-cluster     Sets a cluster entry in kubeconfig
  set-context     Sets a context entry in kubeconfig
  set-credentials Sets a user entry in kubeconfig
  unset           Unsets an individual value in a kubeconfig file
  use-context     Sets the current-context in a kubeconfig file
  view            Display merged kubeconfig settings or a specified kubeconfig file

Usage:
  kubectl config SUBCOMMAND [options]

Use "kubectl <command> --help" for more information about a given command.
Use "kubectl options" for a list of global command-line options (applies to all commands).
ANOTE.DEV