.. iqi1581955028595 .. _security-install-kubectl-and-helm-clients-directly-on-a-host: =================================================== Install Kubectl and Helm Clients Directly on a Host =================================================== You can use :command:`kubectl` and :command:`helm` to interact with a controller from a remote system. .. rubric:: |context| Commands such as those that reference local files or commands that require a shell are more easily used from clients running directly on a remote workstation. Complete the following steps to install :command:`kubectl` and :command:`helm` on a remote system. The following procedure shows how to configure the kubectl and helm clients directly on remote host, for an admin user with **cluster-admin** cluster role. If using a non-admin user such as one with only role privileges within a private namespace, the procedure is the same, however, additional configuration is required in order to use :command:`helm`. .. rubric:: |proc| .. _security-install-kubectl-and-helm-clients-directly-on-a-host-steps-f54-qqd-tkb: #. On the controller, if an **admin-user** service account is not already available, create one. #. Create the **admin-user** service account in **kube-system** namespace and bind the **cluster-admin** ClusterRoleBinding to this user. .. code-block:: none % cat < admin-login.yaml apiVersion: v1 kind: ServiceAccount metadata: name: kubernetes-admin namespace: kube-system --- apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: kubernetes-admin roleRef: apiGroup: rbac.authorization.k8s.io kind: ClusterRole name: cluster-admin subjects: - kind: ServiceAccount name: kubernetes-admin namespace: kube-system EOF % kubectl apply -f admin-login.yaml #. Retrieve the secret token. .. code-block:: none ~(keystone_admin)]$ TOKEN_DATA=$(kubectl -n kube-system describe secret $(kubectl -n kube-system get secret | grep kubernetes-admin | awk '{print $1}') | grep "token:" | awk '{print $2}') #. On a remote workstation, install the :command:`kubectl` client. Go to the following link: `https://kubernetes.io/docs/tasks/tools/install-kubectl-linux/ `__. #. Install the :command:`kubectl` client CLI (for example, an Ubuntu host). .. code-block:: none % sudo apt-get update % sudo apt-get install -y apt-transport-https % curl -s https://packages.cloud.google.com/apt/doc/apt-key.gpg | \ sudo apt-key add % echo "deb https://apt.kubernetes.io/ kubernetes-xenial main" | \ sudo tee -a /etc/apt/sources.list.d/kubernetes.list % sudo apt-get update % sudo apt-get install -y kubectl #. Set up the local configuration and context. .. note:: In order for your remote host to trust the certificate used by the |prod-long| K8S API, you must ensure that the ``k8s_root_ca_cert`` specified at install time is a trusted |CA| certificate by your host. Follow the instructions for adding a trusted |CA| certificate for the operating system distribution of your particular host. If you did not specify a ``k8s_root_ca_cert`` at install time, then specify ``--insecure-skip-tls-verify``, as shown below. The following example configures the default ~/.kube/config. See the following reference: `https://kubernetes.io/docs/tasks/access-application-cluster/configure-access-multiple-clusters/ `__. You need to obtain a floating |OAM| IP. .. code-block:: none % kubectl config set-cluster mycluster --server=https://${OAM_IP}:6443 \ --insecure-skip-tls-verify % kubectl config set-credentials kubernetes-admin@mycluster --token=$TOKEN_DATA % kubectl config set-context kubernetes-admin@mycluster --cluster=mycluster \ --user kubernetes-admin@mycluster --namespace=default % kubectl config use-context kubernetes-admin@mycluster ``$TOKEN_DATA`` is the token retrieved in step 1. #. Test remote :command:`kubectl` access. .. code-block:: none % kubectl get nodes -o wide NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE ... controller-0 Ready master 15h v1.12.3 192.168.204.3 CentOS L ... controller-1 Ready master 129m v1.12.3 192.168.204.4 CentOS L ... worker-0 Ready 99m v1.12.3 192.168.204.201 CentOS L ... worker-1 Ready 99m v1.12.3 192.168.204.202 CentOS L ... % #. On the workstation, install the :command:`helm` client on an Ubuntu host by taking the following actions on the remote Ubuntu system. #. Install :command:`helm`. See the following reference: `https://helm.sh/docs/intro/install/ `__. Helm accesses the Kubernetes cluster as configured in the previous step, using the default ~/.kube/config. .. code-block:: none % wget https://get.helm.sh/helm-v3.2.1-linux-amd64.tar.gz % tar xvf helm-v3.2.1-linux-amd64.tar.gz % sudo cp linux-amd64/helm /usr/local/bin #. Verify that :command:`helm` installed correctly. .. code-block:: none % helm version version.BuildInfo{Version:"v3.2.1", GitCommit:"fe51cd1e31e6a202cba7dead9552a6d418ded79a", GitTreeState:"clean", GoVersion:"go1.13.10"} #. Run the following commands: .. code-block:: none % helm repo add bitnami https://charts.bitnami.com/bitnami % helm repo update % helm repo list % helm search repo % helm install wordpress bitnami/wordpress .. seealso:: :ref:`Configure Container-backed Remote CLIs and Clients ` :ref:`Using Container-backed Remote CLIs and Clients ` :ref:`Configure Remote Helm v2 Client `