使用客户端证书进行身份验证的Curl minikube apiserver

如何解决使用客户端证书进行身份验证的Curl minikube apiserver

有关使用curl和客户端证书和密钥对minikube api服务器进行身份验证的基本问题。

当我在api服务器上卷曲/ping端点时，我得到了403（预期失败，验证失败）

curl -k https://127.0.0.1:32776/ping

{
  "kind": "Status","apiVersion": "v1","metadata": {

  },"status": "Failure","message": "forbidden: User \"system:anonymous\" cannot get path \"/ping\"","reason": "Forbidden","details": {

  },"code": 403
}

要解决此问题，我正在尝试使用下面的curl命令

curl -v
--cert /Users/blah/.minikube/profiles/minikube/client.crt \
--cacert /Users/blah/.minikube/ca.cert \
--key /Users/blah/.minikube/profiles/minikube/client.key \
https://127.0.0.1:32776/ping

然后我回来

*   Trying 127.0.0.1:32776...
* Connected to 127.0.0.1 (127.0.0.1) port 32776 (#0)
* ALPN,offering http/1.1
* WARNING: SSL: CURLOPT_SSLKEY is ignored by Secure Transport. The private key must be in the Keychain.
* WARNING: SSL: Certificate type not set,assuming PKCS#12 format.
* SSL: Can't find the certificate "/Users/blah/.minikube/profiles/minikube/client.crt" and its private key in the Keychain.
* Closing connection 0
curl: (58) SSL: Can't find the certificate "/Users/blah/.minikube/profiles/minikube/client.crt" and its private key in the Keychain.

我正在使用上述证书，如 kubectl config view

apiVersion: v1
clusters:
- cluster:
    certificate-authority: /Users/blah/.minikube/ca.crt
    server: https://127.0.0.1:32776
  name: minikube
contexts:
- context:
    cluster: minikube
    user: minikube
  name: minikube
current-context: minikube
kind: Config
preferences: {}
users:
- name: minikube
  user:
    client-certificate: /Users/blah/.minikube/profiles/minikube/client.crt
    client-key: /Users/blah/.minikube/profiles/minikube/client.key

我认为这是我所缺少的更多curl使用细节，minikube似乎很好。 另外，我很好奇其他人如何验证对minikube的curl请求？

解决方法

您使用什么卷曲版本？什么操作系统？不是MacOSX吗？

非常类似的问题Error when trying to access API via curl，也没有看到有效的当前证书。解决方案是将密钥转换为pkcs12。

How to access Kubernetes API using CURL帖子中的RaeesBhatti也建议

我发现我使用了错误的证书和SSL：无法 加载证书[]及其私钥：OSStatus -25299是一个 problem specific to CURL in OS X Mavericks+，其中CURL接受 仅P12格式的证书。您必须在以下位置使用证书 $ HOME / .minikube /目录，而不是$ HOME / .minikube / certs。你也是 必须先convert the certificates into P12格式然后使用它们。