Skip to content

Commit 0a1a9c0

Browse files
iximiuziximiuz
authored
Merge pull request #4 from neilkuan/aws-eks-example-docs
feat: add a docs for aws-eks example
2 parents 93675c9 + 1c9d9dc commit 0a1a9c0

File tree

1 file changed

+164
-0
lines changed

1 file changed

+164
-0
lines changed

‎docs/AWS_EKS_EXAMPLE.md

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
# This is example use `kexp` with AWS EKS
2+
3+
## Create kubeconfig via `aws-cli`
4+
```bash
5+
export YOUR_EKS_NAME="REPLACE_ME"
6+
export YOUR_EKS_REGION="REPLACE_ME"
7+
aws eks update-kubeconfig --name ${YOUR_EKS_NAME} --region ${YOUR_EKS_REGION} --kubeconfig ~/demo-kexp.config
8+
9+
10+
--- output ---
11+
Added new context arn:aws:eks:${YOUR_EKS_REGION}:your-account:cluster/${YOUR_EKS_NAME} to ~/demo-kexp.config
12+
```
13+
14+
## Create service account to access eks cluster.
15+
1. create service account `viewer-sa`.
16+
```bash
17+
echo '
18+
apiVersion: v1
19+
kind: ServiceAccount
20+
metadata:
21+
namespace: default
22+
name: viewer-sa' | kubectl apply -f -
23+
```
24+
```bash
25+
--- output ---
26+
serviceaccount/viewer-sa created
27+
```
28+
2. Binding cluster-role view to service account viewer-sa.
29+
```bash
30+
echo '
31+
apiVersion: rbac.authorization.k8s.io/v1
32+
kind: ClusterRoleBinding
33+
metadata:
34+
name: viewer-sa-cluster-role-binding
35+
roleRef:
36+
apiGroup: rbac.authorization.k8s.io
37+
kind: ClusterRole
38+
name: view
39+
subjects:
40+
- kind: ServiceAccount
41+
namespace: default
42+
name: viewer-sa' | kubectl apply -f -
43+
```
44+
```bash
45+
--- output ---
46+
clusterrolebinding.rbac.authorization.k8s.io/viewer-sa-cluster-role-binding created
47+
```
48+
3. Get viewer-sa token (default expired after 1h).
49+
- copy the output `jwt` token.
50+
```bash
51+
## 1h expired.
52+
kubectl create token viewer-sa -n default
53+
```
54+
```bash
55+
--- output ---
56+
eyJhbGciOiJSUzI1NiIsImtpZCI6IjI3MGJlMjFiOTc4YmZhZjAzZTBlODBiMWIzODcexampleexampleexampleexample.exampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexample.exampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexample-EX4xANwa_HjqgT5BBgObWa1wFhH4kAS2ULpnzioLyDex46wfxPq13OeHZIcXE9EwBERO4g8Wr2R0_PQ
57+
```
58+
- EKS limit token only setting duration 1d(24h).
59+
```bash
60+
## EKS limit token only setting duration 1d(24h).
61+
export JWT=$(kubectl create token viewer-sa --duration 24h)
62+
```
63+
64+
- If you request over 1d, you will get this warning message.
65+
```bash
66+
kubectl create token viewer-sa --duration 100h
67+
Warning: requested expiration of 360000 seconds shortened to 86400 seconds
68+
```
69+
4. update `~/demo-kexp.config`
70+
- replace `users.[0].user.exec` to `users.[0].user.token`
71+
before:
72+
- 🚨 🚨 🚨 please replcae `arn:aws:eks:AWS_REGION:ACCOUNT_ID:cluster/$EKS_CLUSTER_NAME` -> `$EKS_CLUSTER_NAME` 🚨 🚨 🚨
73+
```bash
74+
apiVersion: v1
75+
clusters:
76+
- cluster:
77+
certificate-authority-data: EXAMPLE0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lJUkEvREYrQjl6Q0F3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TXpFd01qUXdPREkxTVRaYUZ3MHpNekV3TWpFd09ETXdNVFphTUJVeApFekFSQmdOVkJBTVRDbXQxWW1WeWJtVjBaWE13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLCkFvSUJBUUNaakd6djFYcXVHMFVDUWFsRzg2aGUrOEtjMDVsTGN3QUhRdy9XeGtZZzAwRWNrRXFqQmNkQ1laL2EKYXJ6TXhISUJvbVJRMjgwbG9xQUx5azdMWmZYK1NaTjEvSVcyMnY0UC9kcmRiZjN1WXFFTjRRN2RoQ1h6VlJ0dwpTQUJKUEpqbVRDNldpZHlVZ0ZxUFpJNndJT2IyemhsSGJWa3MzditUL1JXV2xmbm5oL0gxL2dMb0VQUUpwTFg4CjNiNFJXNWYzdGRZNEFJcHlheVBWNW1Eb29XRVlRcWVMYzdrcDVvSU8xQTVDNk9ZSDgwbXJobDZoNzNwN2lTb2MKb1Y3RjY3UnZDVnN5NE9ZcnMrWXkreHlHQ3A3RlVUdUMrSEw4Wlc2ekIyUkZadGNNVUtIYkxXMUw4cGpWblFwNAorSDM4aEt4OWhmdFVRYVNCK004NThUK1d0YlhQQWdNQkFBR2pXVEJYTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1EXAMPLEcGl2YklPNWphWFFTc1lHWGRtLzNEQVYKQmdOVkhSRUVEakFNZ2dwcmRXSmxjbTVsZEdWek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQXJsMVNYenJNeApSbWlWYmMyaFdOOFhSbHpXa3AxM3hsS1JVZlZFU09FMVg4WVVvTGxaNTZvZTdZWGZ1cVd0UGR5TE41SDNCcU1FCjZtWGRMYWpRN0NJclZCTHhia3B6YmNkUWM4U0NQdXJNdjB6R2JQd1BMdzFpb2dZYTJLM2crRUlrZmJlZThzM3oKZVZSTCs5R0szNXNRZVNocFRxMTJmdEXAMPLEcXZOaW9PUytrUVFwbmNiWXUxS3loSktZazFEd2l6SDYwbgptRlFvRGRpN1hzNFZsaWVZSFVlNXk0MjlFUFd5akJCYWd3NWxReEJsaGdQOHYyb1Fwd3VUbUtHQ2JDUytYSzB6CnQ1UGZ5UlkwZzBaeUExWnNFUnJpenlyb1N0QTM2ellvUHZRblRwNnVHdTBDRTlwWW41bklhYjRqR2RxQW1XaUkKbzVvSUsyclp0NTJECi0tLS0tRU5EIENFUlREXAMPLEXAMPLE
78+
server: https://EXAMPLEEXAMPLEEXAMPLE.gr7.AWS_REGION.eks.amazonaws.com
79+
name: arn:aws:eks:AWS_REGION:ACCOUNT_ID:cluster/$EKS_CLUSTER_NAME
80+
contexts:
81+
- context:
82+
cluster: arn:aws:eks:AWS_REGION:ACCOUNT_ID:cluster/$EKS_CLUSTER_NAME
83+
user: arn:aws:eks:AWS_REGION:ACCOUNT_ID:cluster/$EKS_CLUSTER_NAME
84+
name: arn:aws:eks:AWS_REGION:ACCOUNT_ID:cluster/$EKS_CLUSTER_NAME
85+
current-context: arn:aws:eks:AWS_REGION:ACCOUNT_ID:cluster/$EKS_CLUSTER_NAME
86+
kind: Config
87+
preferences: {}
88+
users:
89+
- name: arn:aws:eks:AWS_REGION:ACCOUNT_ID:cluster/$EKS_CLUSTER_NAME
90+
user:
91+
exec: <--- The part to replace --->
92+
apiVersion: client.authentication.k8s.io/v1beta1
93+
args:
94+
- --region
95+
- AWS_REGION
96+
- eks
97+
- get-token
98+
- --cluster-name
99+
- $EKS_CLUSTER_NAME
100+
- --output
101+
- json
102+
command: aws
103+
```
104+
after:
105+
```bash
106+
apiVersion: v1
107+
clusters:
108+
- cluster:
109+
certificate-authority-data: EXAMPLE0FURS0tLS0tCk1JSURCVENDQWUyZ0F3SUJBZ0lJUkEvREYrQjl6Q0F3RFFZSktvWklodmNOQVFFTEJRQXdGVEVUTUJFR0ExVUUKQXhNS2EzVmlaWEp1WlhSbGN6QWVGdzB5TXpFd01qUXdPREkxTVRaYUZ3MHpNekV3TWpFd09ETXdNVFphTUJVeApFekFSQmdOVkJBTVRDbXQxWW1WeWJtVjBaWE13Z2dFaU1BMEdDU3FHU0liM0RRRUJBUVVBQTRJQkR3QXdnZ0VLCkFvSUJBUUNaakd6djFYcXVHMFVDUWFsRzg2aGUrOEtjMDVsTGN3QUhRdy9XeGtZZzAwRWNrRXFqQmNkQ1laL2EKYXJ6TXhISUJvbVJRMjgwbG9xQUx5azdMWmZYK1NaTjEvSVcyMnY0UC9kcmRiZjN1WXFFTjRRN2RoQ1h6VlJ0dwpTQUJKUEpqbVRDNldpZHlVZ0ZxUFpJNndJT2IyemhsSGJWa3MzditUL1JXV2xmbm5oL0gxL2dMb0VQUUpwTFg4CjNiNFJXNWYzdGRZNEFJcHlheVBWNW1Eb29XRVlRcWVMYzdrcDVvSU8xQTVDNk9ZSDgwbXJobDZoNzNwN2lTb2MKb1Y3RjY3UnZDVnN5NE9ZcnMrWXkreHlHQ3A3RlVUdUMrSEw4Wlc2ekIyUkZadGNNVUtIYkxXMUw4cGpWblFwNAorSDM4aEt4OWhmdFVRYVNCK004NThUK1d0YlhQQWdNQkFBR2pXVEJYTUE0R0ExVWREd0VCL3dRRUF3SUNwREFQCkJnTlZIUk1CQWY4RUJUQURBUUgvTUIwR0ExVWREZ1EXAMPLEcGl2YklPNWphWFFTc1lHWGRtLzNEQVYKQmdOVkhSRUVEakFNZ2dwcmRXSmxjbTVsZEdWek1BMEdDU3FHU0liM0RRRUJDd1VBQTRJQkFRQXJsMVNYenJNeApSbWlWYmMyaFdOOFhSbHpXa3AxM3hsS1JVZlZFU09FMVg4WVVvTGxaNTZvZTdZWGZ1cVd0UGR5TE41SDNCcU1FCjZtWGRMYWpRN0NJclZCTHhia3B6YmNkUWM4U0NQdXJNdjB6R2JQd1BMdzFpb2dZYTJLM2crRUlrZmJlZThzM3oKZVZSTCs5R0szNXNRZVNocFRxMTJmdEXAMPLEcXZOaW9PUytrUVFwbmNiWXUxS3loSktZazFEd2l6SDYwbgptRlFvRGRpN1hzNFZsaWVZSFVlNXk0MjlFUFd5akJCYWd3NWxReEJsaGdQOHYyb1Fwd3VUbUtHQ2JDUytYSzB6CnQ1UGZ5UlkwZzBaeUExWnNFUnJpenlyb1N0QTM2ellvUHZRblRwNnVHdTBDRTlwWW41bklhYjRqR2RxQW1XaUkKbzVvSUsyclp0NTJECi0tLS0tRU5EIENFUlREXAMPLEXAMPLE
110+
server: https://example.gr7.AWS_REGION.eks.amazonaws.com
111+
name: $EKS_CLUSTER_NAME
112+
contexts:
113+
- context:
114+
cluster: $EKS_CLUSTER_NAME
115+
user: $EKS_CLUSTER_NAME
116+
name: $EKS_CLUSTER_NAME
117+
current-context: $EKS_CLUSTER_NAME
118+
kind: Config
119+
preferences: {}
120+
users:
121+
- name: $EKS_CLUSTER_NAME
122+
user:
123+
token: eyJhbGciOiJSUzI1NiIsImtpZCI6IjI3MGJlMjFiOTc4YmZhZjAzZTBlODBiMWIzODcexampleexampleexampleexample.exampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexample.exampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexampleexample-EX4xANwa_HjqgT5BBgObWa1wFhH4kAS2ULpnzioLyDex46wfxPq13OeHZIcXE9EwBERO4g8Wr2R0_PQ
124+
```
125+
126+
## Running the `kexp` with custom kubeconfig.
127+
```bash
128+
129+
kexp --host 0.0.0.0 --port 8090 --kubeconfig ~/demo-kexp.config
130+
131+
132+
--- output ---
133+
{"contexts":[{}],"level":"debug","msg":"Kube context discovery finished","time":"2023-11-03T09:58:37+08:00"}
134+
{"level":"info","msg":"Starting server on 0.0.0.0:8090","time":"2023-11-03T09:58:37+08:00"}
135+
[GIN-debug] [WARNING] Running in "debug" mode. Switch to "release" mode in production.
136+
- using env: export GIN_MODE=release
137+
- using code: gin.SetMode(gin.ReleaseMode)
138+
139+
[GIN-debug] GET /api/kube/v1/contexts/ --> github.com/iximiuz/kexp/api/rest/kube/contexts.(*Handler).List-fm (3 handlers)
140+
[GIN-debug] GET /api/kube/v1/contexts/:ctx/resources/ --> github.com/iximiuz/kexp/api/rest/kube/resources.(*Handler).List-fm (3 handlers)
141+
[GIN-debug] GET /api/kube/v1/contexts/:ctx/resources/:group/:version/:resource/ --> github.com/iximiuz/kexp/api/rest/kube/objects.(*Handler).List-fm (3 handlers)
142+
[GIN-debug] GET /api/kube/v1/contexts/:ctx/resources/:group/:version/namespaces/:namespace/:resource/ --> github.com/iximiuz/kexp/api/rest/kube/objects.(*Handler).List-fm (3 handlers)
143+
[GIN-debug] GET /api/kube/v1/contexts/:ctx/resources/:group/:version/:resource/:name/ --> github.com/iximiuz/kexp/api/rest/kube/objects.(*Handler).Get-fm (3 handlers)
144+
[GIN-debug] GET /api/kube/v1/contexts/:ctx/resources/:group/:version/namespaces/:namespace/:resource/:name/ --> github.com/iximiuz/kexp/api/rest/kube/objects.(*Handler).Get-fm (3 handlers)
145+
[GIN-debug] PUT /api/kube/v1/contexts/:ctx/resources/:group/:version/:resource/:name/ --> github.com/iximiuz/kexp/api/rest/kube/objects.(*Handler).Update-fm (3 handlers)
146+
[GIN-debug] PUT /api/kube/v1/contexts/:ctx/resources/:group/:version/namespaces/:namespace/:resource/:name/ --> github.com/iximiuz/kexp/api/rest/kube/objects.(*Handler).Update-fm (3 handlers)
147+
[GIN-debug] DELETE /api/kube/v1/contexts/:ctx/resources/:group/:version/:resource/:name/ --> github.com/iximiuz/kexp/api/rest/kube/objects.(*Handler).Delete-fm (3 handlers)
148+
[GIN-debug] DELETE /api/kube/v1/contexts/:ctx/resources/:group/:version/namespaces/:namespace/:resource/:name/ --> github.com/iximiuz/kexp/api/rest/kube/objects.(*Handler).Delete-fm (3 handlers)
149+
[GIN-debug] GET /api/stream/v1/ --> github.com/iximiuz/kexp/api/stream.(*Handler).Connect-fm (3 handlers)
150+
[GIN-debug] GET /ui/*filepath --> github.com/gin-gonic/gin.(*RouterGroup).createStaticHandler.func1 (3 handlers)
151+
[GIN-debug] HEAD /ui/*filepath --> github.com/gin-gonic/gin.(*RouterGroup).createStaticHandler.func1 (3 handlers)
152+
[GIN-debug] GET / --> main.run.func1.1 (3 handlers)
153+
[GIN-debug] [WARNING] You trusted all proxies, this is NOT safe. We recommend you to set a value.
154+
Please check https://pkg.go.dev/github.com/gin-gonic/gin#readme-don-t-trust-all-proxies for details.
155+
[GIN-debug] Listening and serving HTTP on 0.0.0.0:8090
156+
[GIN] 2023/11/03 - 09:58:42 | 200 | 4.464041ms | ::1 | GET "/ui/"
157+
[GIN] 2023/11/03 - 09:58:42 | 200 | 126.209µs | ::1 | GET "/ui/fonts/inter/inter.css"
158+
[GIN] 2023/11/03 - 09:58:42 | 200 | 1.163834ms | ::1 | GET "/ui/assets/index-1d5c257f.css"
159+
[GIN] 2023/11/03 - 09:58:42 | 200 | 3.788ms | ::1 | GET "/ui/assets/index-bc11076a.js"
160+
[GIN] 2023/11/03 - 09:58:42 | 200 | 297.459µs | ::1 | GET "/api/kube/v1/contexts/"
161+
[GIN] 2023/11/03 - 09:58:42 | 200 | 234.169167ms | ::1 | GET "/api/kube/v1/contexts/aws-eks-cluster-name/resources/"
162+
[GIN] 2023/11/03 - 09:58:42 | 200 | 89.917µs | ::1 | GET "/ui/logos/github.png"
163+
[GIN] 2023/11/03 - 09:58:42 | 200 | 1.35875ms | ::1 | GET "/ui/fonts/inter/Inter-roman.var.woff2?v=3.19"
164+
```

0 commit comments

Comments
 (0)