Curl minikube apiserver using client certs for authentication

user_1922091 0
Viewed 775

Basic question about authenticating to minikube api-server using curl with client cert and key.

When I curl /ping endpoint on api-server, I get back a 403 (expected, fails authentication)

curl -k https://127.0.0.1:32776/ping

{
  "kind": "Status",
  "apiVersion": "v1",
  "metadata": {

  },
  "status": "Failure",
  "message": "forbidden: User \"system:anonymous\" cannot get path \"/ping\"",
  "reason": "Forbidden",
  "details": {

  },
  "code": 403
}

And to fix the same, I'm trying the below curl command I'm using

curl -v
--cert /Users/blah/.minikube/profiles/minikube/client.crt \
--cacert /Users/blah/.minikube/ca.cert \
--key /Users/blah/.minikube/profiles/minikube/client.key \
https://127.0.0.1:32776/ping

and I get back

*   Trying 127.0.0.1:32776...
* Connected to 127.0.0.1 (127.0.0.1) port 32776 (#0)
* ALPN, offering http/1.1
* WARNING: SSL: CURLOPT_SSLKEY is ignored by Secure Transport. The private key must be in the Keychain.
* WARNING: SSL: Certificate type not set, assuming PKCS#12 format.
* SSL: Can't find the certificate "/Users/blah/.minikube/profiles/minikube/client.crt" and its private key in the Keychain.
* Closing connection 0
curl: (58) SSL: Can't find the certificate "/Users/blah/.minikube/profiles/minikube/client.crt" and its private key in the Keychain.

I'm using the above certs as described in kubectl config view

apiVersion: v1
clusters:
- cluster:
    certificate-authority: /Users/blah/.minikube/ca.crt
    server: https://127.0.0.1:32776
  name: minikube
contexts:
- context:
    cluster: minikube
    user: minikube
  name: minikube
current-context: minikube
kind: Config
preferences: {}
users:
- name: minikube
  user:
    client-certificate: /Users/blah/.minikube/profiles/minikube/client.crt
    client-key: /Users/blah/.minikube/profiles/minikube/client.key

I think this is more of curl usage details that I'm missing, minikube seems to be fine. Also, I'm curious how others authenticating curl requests to minikube?

minikube client-certificates kubernetes curl
1 Answers

what curl version you use? and what OS? Isn't it MacOSX?

Very similar issue Error when trying to access API via curl, where also valid present certificate hasnt seen. Resolution was to convert key to pkcs12.

RaeesBhatti in How to access Kubernetes API using CURL post also suggests

I found out that I was using wrong certificates and the SSL: Can't load the certificate [] and its private key: OSStatus -25299 is a problem specific to CURL in OS X Mavericks+ where CURL accepts certificates of only P12 format. You have to use certificates in $HOME/.minikube/ directory instead $HOME/.minikube/certs. You also have to convert the certificates into P12 format and then use them.

user_99290150
Related