User kubeconfig server example configuration

This page provides an annotated example configuration for the user kubeconfig server.
See the parameter reference for detailed parameter documentation.
The user kubeconfig server assumes a cluster which is managed by a self-contained cluster API instance on the cluster.

Prerequisites

  • You have a cluster that’s managed by a cluster API instance which is deployed from this component.

  • The cluster’s API certificate is configured with DNS name api.c-green-test-1234.example.com in addition to any other required names.

  • The cluster’s API server is configured with OIDC authentication to a Keycloak realm hosted at keycloak.example.com/auth/realms/example-com.

  • The cluster’s OIDC client on keycloak.example.com has client ID capi_c-green-test-1234.

  • The cluster’s cert-manager instance provides a ClusterIssuer for Let’s Encrypt which is called letsencrypt-production.

  • You’ve setup a DNS record which points kubeconfig.c-green-test-1234.example.com to the cluster’s primary ingress controller.

Example configuration

parameters:
  capi_core:
    kubeconfig:
      serverURL: kubeconfig.c-green-test-1234.example.com (1)
      apiURL: api.c-green-test-1234.example.com (2)
      oidc:
        issuerURL: https://keycloak.example.com/auth/realms/example-com (3)
        clientId: capi_c-green-test-1234 (4)
      ingress:
        metadata:
          annotations:
            cert-manager.io/cluster-issuer: letsencrypt-production (5)
        spec:
          tls:
            - hosts: [ ${capi_core:kubeconfig:serverURL} ] (6)
              secretName: user-kubeconfig-tls (7)
1 The user kubeconfig page will be served on this URL.
2 The user kubeconfig’s clusters[0].cluster.server will be set to this URL.
3 The user kubeconfig’s user will be configured to use [kubelogin] with --oidc-issuer-url=https://keycloak.example.com/auth/realms/example-com.
4 The user kubeconfig’s user will be configured to use [kubelogin] with --oidc-client-id=capi_c-green-test-1234.
5 With annotation cert-manager.io/cluster-issuer=letsencrypt-production, the user kubeconfig Ingress resource is configured to request a Let’s Encrypt certificate via cert-manager.
6 The secret name can be chosen arbitrarily. However, we recommend keeping prefix user-kubeconfig to avoid collisions with other secrets in the syn-cluster-api namespace.