Generate Basic Auth credentials

[yissachar]

It would be nice to have Basic Auth credentials generated as part of the cluster set up. This would make it easier to login to the dashboard through a browser.

[justinsb]

Agreed that we can make this better.

But they are generated and available: kops secret expose --id=kube --type=secret should tell you the password. Username is admin.

(And this should be id=admin; the syntax is inconsistent and should be documented. I think we have issues for those already though!)

[yissachar]

Thanks, that worked (small typo: kops secret -> kops secrets).

The reason I assumed that they weren't generated is because they don't show up in .kube/config or kube config view, even though all the other settings for my cluster show up there. Is there a reason for this?

[justinsb]

They aren't actually needed in kubecfg - kubelet uses the client cert instead.

I am wondering if I should put them in there anyway; it is a convenient place to find them.

[boydgreenfield]

Apologies if I'm missing something obvious, but how do I expose the bearer token for use with bearer token auth against the API @justinsb?

[boydgreenfield]

Nvm – and update for anyone stumbling across this, it appears that --id=admin --type=secret reveals the bearer token.

[talon-vonneudeck]

For kops version Version git-5191616 the command kops secrets expose --id=kube --type=secret gives unknown flag: --id back.
But kops get secrets -oplaintext --type=secret kube gives the basic auth secret back.

[justinsb]

We now:

• write the password to kubecfg
• document the password in the dashboard addon docs
• document the password location in the (nascent) security doc

It's still not perfect, but hopefully this is sufficient for the moment!