how to authenticate to google container engine kub

问题:

I'm trying to write a service that spawns container based applications within a Kubernetes cluster. I'd like to do some testing against Google Container Engine as a baseline; however, I am having trouble figuring out how to get my REST client to authenticate with the k8s API server (the master).

I came across a good hint here: http://www.scriptscoop.net/t/9c6a16719a43/google-container-engine-rest-api-authorization.html

The author says "I know that OAuth works [against Google Container Engine]", and they sound knowledgable. So, I'm thinking of trying oauth (I guess oauth2.) However, trial and error will take me a lot longer than adapting from some working code that works against Google Container Engine via either the k8s REST or fabric8 API.

If anyone can give me a pointer to such code, or even discussions of such code, I'd appreciate it very much ! thanks /chris

回答1:

The Kubernetes apiserver doesn't (yet) work with OAuth, so you will need to use one of the supported authentication mechanisms (http basic auth, bearer token auth, or client certificates) when making API requests.

Every pod has a service account automatically applied that allows it to access the apiserver using a bearer token. See How do I access the Kubernetes api from within a pod container?.

With the credentials from the service account, you can deploy an application that will create new objects in the system (pods, replication controllers, etc) to spawn container based applications.