<p>I'm a little lost trying to get acccess to a Kubernetes cluster hosted on Google Kubernetes Engine.</p>
<p>I would like to use a cluster certificate to authenticate to the provided kubernetes endpoint, so that I can run API requests to the kubernetes api, like creating deployments for example.</p>
<p>I'm trying to create deployments from an external API (from a NodeJS app, hosted on google app engine), where I will automatically create deployments on various different kubernetes clusters, not necessarily in the same google project.</p>
<p>I used to use basic auth to authenticate to the kubernetes api, this was trivial, all I needed was the username and password for a cluster, and then to base64 encode the two and put it in an Authentication header. I did this using axios and had no problems at all.</p>
<p>Now I'd like to switch over to using client certificates and I think I lack some understanding.</p>
<p>I guess I need to get the provided endpoint ip of the cluster, download the cluster certificate provided by google... that looks something like this:</p>
<p><a href="https://i.stack.imgur.com/JVcOj.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/JVcOj.jpg" alt="enter image description here" /></a></p>
<p>...possibly base64 encode it and save it as a .crt, .cert, or ??.pem file and point axios to the file using a httpagent? (I tried saving the raw data as a .crt and .cert file, setting it as a httpagent and this unsurprisingly didn't work).</p>
<p>Do I need some kind of client/server key pair for the certificate, or maybe an API key?</p>
<p>I also read something about setting a Bearer token as an Authorization header, I guess this needs to be paired with the certificate, but I'm unsure where I can find/generate this token?</p>
<p>If there's anyone who can help with this obscure issue I'd be very grateful,</p>
<p>Thanks in advance!</p>
<p>P.S. I've been trying to decipher the K8s docs and I think I'm close, but I'm still not sure I'm looking at the right docs: <a href="https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/" rel="nofollow noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/</a></p>

Emile Esterhuizen
<p>I've resolved the issue and I thought I'd post an answer in case someone is in my situation and needs a reference.</p>
<p><a href="https://stackoverflow.com/a/65025216/1722995">Alberto's</a> answer is a great one, and I think this is the most secure mindset to have, its definitely preferable to keep everything internal to the google environment. But in my case, even if just for testing, I really needed to interface with the kubernetes API over https from another domain.</p>
<p>It turns out that it was simpler than I anticipated, instead of using the CA certificate, what I needed to do was to fetch a service account token from google cloud shell and place this in the Authorization header (very similar to basic auth). (In addition I should check the validity of the kubernetes endpoint by using the service account's client certificate, but I did not so this.)</p>
<p>Once in the google cloud shell and authenticated to the relevant cluster run the following:</p>
<ol>
<li><code>kubectl get serviceaccount</code></li>
<li><code>kubectl get serviceaccount default -o yaml</code></li>
<li><code>kubectl get secret-default-token-some_id_string -o yaml</code></li>
<li><code>kubectl create clusterrolebinding default-serviceaccount-admin --clusterrole=cluster-admin --serviceaccount=default:default</code></li>
</ol>
<p><strong>Point 1</strong> displays whether there is in fact a default service account present, this should be the case with a cluster created on Google Kubernetes Engine.</p>
<p><strong>Point 2</strong> prints out which service account is the default and should provide a service account name, something like &quot;secret-default-token-abcd&quot;</p>
<p><strong>Point 3</strong> prints out the token as well as its corresponding certificate. The token is printed as a base64 encoded string and needs to be decoded before it can be used in a http request.</p>
<p><strong>Point 4</strong> assigns the default service account a role (part of the Kubernetes RBAC thing) so that it has the correct permissions to create and delete deployments in the cluster.</p>
<p>Then in postman or wherever you're making the Kubernetes api call, set an Authorization header as follows:</p>
<p><code>Authorization: Bearer &lt;base64 decoded token received in point 3&gt;</code></p>
<p>Now you can make calls directly to the kubernetes api, for example, to create or delete deployments.</p>
<p>As mentioned above the certificate also provided as a base64 encoded string in Point 3, can be used to verify the kubernetes endpoint, but I haven't tested this (definitely more secure way of doing things).</p>
<p>In addition I was making the http call in a nodejs script and I had to set an environment variable <code>process.env.NODE_TLS_REJECT_UNAUTHORIZED = &quot;0&quot;;</code> to override the certificate check... definitely not a safe way to go and not recommended.</p>
