hyper-kube-config

hyper-kube-config - Provides a secure Serverless API to store and retrieve Kubernetes cluster config credentials. hyper-kube-config leverages AWS Secrets Manager for storing credential information. Included is a kubectl plugin to interface with hyperkube API. It just requires a configuration file. See hyperkube.yaml.example for layout.

Install hyperkube kubectl plugin

pip3 install hyper-kube-config 

Post cluster and creds to hyperkube store

kubectl hyperkube -c ~/hyperkube.yaml add --k8s-config ~/.kube/config

Remove cluster and creds

kubectl hyperkube -c ~/hyperkube.yaml remove --cluster-to-remove 'k8s-cluster-example.cloud' 

Get user creds

kubectl hyperkube -c ~/hyperkube.yaml get --cluster cloud-infra.cloud

Get user creds multiple clusters

kubectl hyperkube -c ~/hyperkube.yaml get \
  --cluster cloud-infra.cloud \
  --cluster bar-cluster.cloud \
  --cluster baz-cluster.com 

List clusters

kubectl hyperkube -c ~/hyperkube-config.yaml list

Requirements

• Serverless - Serverless Framework
• Docker - For serverless deploy
• HTTPie - recommended for API client
• serverless-python-requirements plugin. Uses Docker and Pip to package a newer vesion of Boto3 for AWS Lambda function use. AWS Lambda boto3 version by default doesn't have AWS Secrets Manager support for tags.
• click - for hyperkube kubectl plugin
• kubectl - version 1.12 or higher recommended for stable plugin support.

Deploying Serverless API

sls deploy \
  --stage dev \
  --product k8s \
  --owner [email protected] \
  --team myteam \
  --environment dev

This will launch your hyperkube API. Capture the API URL, api key and stage for your hyperkube.yaml configuration. The kubectl hyperkube commands will leverage the config to interact with your stored k8s configs.

Serverless will launch an AWS API Gateway to handle API requests forwardered to AWS Lambda functions. A Dynamodb table is configured to store non-senstative cluster config details, while sensative information in uploaded configs (passwords and certs) is stored in AWS Secrets Manager.