<p>I'm trying to integrate Kubernetes cluster with Gitlab for using the Gitlab Review Apps feature.</p>

<ul>
<li>Kubernetes cluster is created via Rancher 1.6</li>
<li>Running the <code>kubectl get all</code> from the kubernetes shell gives</li>
</ul>

<blockquote>
<pre><code>NAME             TYPE           CLUSTER-IP     EXTERNAL-IP    PORT(S)        AGE
svc/my-service   LoadBalancer   x.x.144.67     x.x.13.89   80:32701/TCP      30d
svc/kubernetes   ClusterIP      10.43.0.1      &lt;none&gt;         443/TCP        30d
</code></pre>
</blockquote>

<ul>
<li>On the Gitlab <code>CI / CD</code> > <code>Kubernetes</code> page, we need to enter mainly 3 fields:

<ol>
<li>API URL</li>
<li>CA Certificate</li>
<li>Token</li>
</ol></li>
</ul>

<h2>API URL</h2>

<ul>
<li>If I'm not wrong, we can get the Kubernetes API URL from <code>Rancher Dashboard</code> > <code>Kubernetes</code> > <code>CLI</code> > <code>Generate Config</code> and copy the <code>server</code> url under <code>cluster</code></li>
</ul>

<blockquote>
<pre><code>apiVersion: v1
kind: Config
clusters:
- cluster:
    api-version: v1
    insecure-skip-tls-verify: true
    server: "https://x.x.122.197:8080/r/projects/1a7/kubernetes:6443"
</code></pre>
</blockquote>

<h2>CA Certificate &amp; Token?</h2>

<ul>
<li>Now, the question is, where to get the CA Certificate (pem format) and the Token?</li>
</ul>

<p>I tried all the <code>ca.crt</code> and <code>token</code> values from all the namespaces from the Kubernetes dashboard, but I'm getting this error on the Gitlab when trying to install <code>Helm Tiller</code> application:</p>

<blockquote>
<pre><code>Something went wrong while installing Helm Tiller

Can't start installation process
</code></pre>
</blockquote>

<p>Here is how my secrets page look like
<a href="https://i.stack.imgur.com/15Imj.png" rel="noreferrer"><img src="https://i.stack.imgur.com/15Imj.png" alt="enter image description here"></a></p>

<p>I'm also dying out with kubernetes and GitLab. I've created a couple single-node "clusters" for testing, one with <a href="https://kubernetes.io/docs/getting-started-guides/minikube/" rel="noreferrer"><code>minikube</code></a> and another via <a href="https://kubernetes.io/docs/setup/independent/create-cluster-kubeadm/" rel="noreferrer"><code>kubeadm</code></a>.</p>

<p>I answered this question on the <a href="https://forum.gitlab.com/t/kubernetes-integration-something-went-wrong-while-installing-helm-tiller/15627/3" rel="noreferrer">GitLab forum</a> but I'm posting my solution below:</p>

<h3>API URL</h3>

<p>According to the <a href="https://gitlab.com/help/user/project/clusters/index.md#adding-an-existing-kubernetes-cluster" rel="noreferrer">official documentation</a>, the API URL is only <code>https://hostname:port</code> without trailing slash </p>

<h3>List secrets</h3>

<p>First, I listed the secrets as usual:</p>

<pre><code>$ kubectl get secrets
NAME                           TYPE                                  DATA      AGE
default-token-tpvsd            kubernetes.io/service-account-token   3         2d
k8s-dashboard-sa-token-XXXXX   kubernetes.io/service-account-token   3         1d
</code></pre>

<h3>Get the service token</h3>

<pre><code>$ kubectl -o json get secret k8s-dashboard-sa-token-XXXXX | jq -r '.data.token' | base64 -d
eyJhbGci    ... sjcuNA8w
</code></pre>

<h3>Get the CA certificate</h3>

<p>Then I got the CA certificate directly from the JSON output via jq with a custom selector:</p>

<pre><code>$ kubectl -o json get secret k8s-dashboard-sa-token-XXXXX | jq -r '.data."ca.crt"' | base64 -d - | tee ca.crt
-----BEGIN CERTIFICATE-----
MIICyDCCAbCgAwIBAgIBADANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDEwprdWJl
...        ...        ...        ...        ...        ...      
FT55iMtPtFqAOnoYBCiLH6oT6Z1ACxduxPZA/EeQmTUoRJG8joczI0V1cnY=
-----END CERTIFICATE-----
</code></pre>

<h3>Verity the CA certificate</h3>

<p>With the CA certificate on hand you can <code>verify</code> as usual:</p>

<pre><code>$ openssl x509 -in ca.crt -noout -subject -issuer
subject= /CN=kubernetes
issuer= /CN=kubernetes

$ openssl s_client -showcerts -connect 192.168.100.20:6443 &lt; /dev/null &amp;&gt; apiserver.crt

$ openssl verify -verbose -CAfile ca.crt apiserver.crt
apiserver.crt: OK
</code></pre>
