https://pulumi.com logo
#kubernetes
Title
# kubernetes
r

rough-author-69114

07/12/2022, 8:50 AM
Hi all. What is best practice to manage admin access to a Kubernetes cluster? I'm creating a cluster with
pulumi_gcp.container.Cluster
and then want to deploy Strimzi operator with
pulumi_kubernetes.helm.v3.Chart
. The problem I run into is that I don't personally have access to the cluster until I run
gcloud container clusters get-gredentials <cluster_name> --region <region>
and generate the configuration, with certificates, for the cluster. I have a few ideas but I feel like I'm missing something that should work better. Idea 1: I can run the command to get the credentials from gcloud with
pulumi_command.local.Command
after the creation of the cluster and before the Chart. I don't particularly like this idea because it changes the state of my personal environment. For the time being it is not a problem, but once we start working with multiple clusters and multiple developers it is bound to cause problems. And then I'm out of ideas. I'll start by trying idea 1 but I hope I can get some more information here.
d

dazzling-oxygen-84405

07/12/2022, 10:33 AM
I solved it like so:
Copy code
command = new remote.Command(...) // generate kubeconfig to stdout
export const kubeconfig = kubeconfigs.admins.stdout;

const provider = new k8s.Provider("k8s", { kubeconfig });

new k8s.helm.v3.Release("foo", {...}, { provider });
However, due to this bug, it means I cannot refresh my stack šŸ˜•
r

rough-author-69114

07/12/2022, 10:57 AM
Thanks @dazzling-oxygen-84405. Have you tried using
remote.run
instead of
remote.Command
? As I understand it the only difference is that Command is managed and run will just execute, i.e. it won't actually be part of the stack.
d

dazzling-oxygen-84405

07/12/2022, 10:58 AM
as far as I can tell,
run
is only available for local commands?
r

rough-author-69114

07/12/2022, 11:01 AM
aha, that sucks. Well, in my case it doesn't matter since I'm running it locally, so I'll try run first.
šŸ‘ 1
can't you run yours locally though? gcloud should be able to reach the gcp api from your local machine too?
d

dazzling-oxygen-84405

07/12/2022, 11:02 AM
Iā€™m not using gcloud, my
Command
is using
kubeadm
to generate the config for an on-prem cluster.
The k8s part should be the same once you have the kubeconfig, so it should still work for you though. Your command just needs to output the kubeconfig to stdout.
r

rough-author-69114

07/12/2022, 11:08 AM
aha, of course, I just assumed you were using some cloud service. my bad
yea, now I have to figure out how to make the gcloud command output to stdout, which seems surprisingly difficult.
9 Views