Red Hat build of MicroShift

Generating additional kubeconfig files for remote access

To support more host names or IP addresses for remote access than the default file provides, you can generate additional kubeconfig files in MicroShift. Add the entries to apiServer.subjectAltNames in config.yaml and restart the service to create the files.

You must restart MicroShift for configuration changes to be implemented.

Prerequisites

You have created a config.yaml file for MicroShift.

Procedure

Optional: You can show the contents of the config.yaml. Run the following command:
```
$ cat /etc/microshift/config.yaml
```

Optional: You can show the contents of the remote-access kubeconfig file. Run the following command:

$ cat /var/lib/microshift/resources/kubeadmin/<hostname>/kubeconfig

Additional remote access kubeconfig files must include one of the server names listed in the {product-title} config.yaml file. Additional kubeconfig files must also use the same CA for validation.

To generate additional kubeconfig files for additional DNS names SANs or external IP addresses, add the entries you need to the apiServer.subjectAltNames field. In the following example, the DNS name used is alt-name-1 and the IP address is 1.2.3.4.
Example config.yaml with additional authentication values
```
dns:
  baseDomain: example.com
node:
  hostnameOverride: "microshift-rhel9"
  nodeIP: 10.0.0.1
apiServer:
  subjectAltNames:
  - alt-name-1
  - 1.2.3.4
```
where:

microshift-rhel9

Specifies the hostname of the node.

alt-name-1

Specifies the DNS name.

1.2.3.4

Specifies the IP address or range.
Restart MicroShift to apply configuration changes and auto-generate the kubeconfig files you need by running the following command:
```
$ sudo systemctl restart microshift
```
To check the contents of additional remote-access kubeconfig files, insert the name or IP address as listed in the config.yaml into the cat command. For example, alt-name-1 is used in the following example command:
```
$ cat /var/lib/microshift/resources/kubeadmin/alt-name-1/kubeconfig
```
Choose the kubeconfig file to use that contains the SAN or IP address you want to use to connect your node. In this example, the kubeconfig containing alt-name-1 in the clusters.cluster.server field is the correct file.
Example contents of an additional kubeconfig file
```
clusters:
- cluster:
    certificate-authority-data: <base64 CA>
    server: https://alt-name-1:6443
```
- The /var/lib/microshift/resources/kubeadmin/alt-name-1/kubeconfig file values are from the apiServer.subjectAltNames configuration values.
  
  All parameters are included as common names (CN) and subject alternative names (SAN) in the external serving certificates for the API server.