Accessing a Cluster Using a Custom Domain Name

Scenario

• Add the domain name mapping by either adding the DNS domain name address in the host domain name configuration on the client or configuring /etc/hosts on the client host.
• Use domain name access in the intranet. DNS allows you to configure mappings between cluster EIPs and custom domain names. After an EIP is updated, you can continue to use two-way authentication and the domain name to access the cluster without downloading the kubeconfig.json file again.
• Add A records on a self-built DNS server.

Prerequisites

Customizing a SAN

1. Log in to the CCE console.
2. Click the name of the target cluster in the cluster list to go to the cluster Overview page.
3. In the Connection Information area, click next to Custom SAN. In the dialog box displayed, enter the IP address or domain name and click Save.
   Note

   • The kube-apiserver will be restarted and the kubeconfig certificate will be updated, which will take approximately 5 minutes. Do not perform any operations on the cluster during this period. After the operation is complete, download the updated kubeconfig certificate.
   • A maximum of 128 domain names or IP addresses, separated by commas (,), are allowed.
   • If a custom domain name needs to be bound to an EIP, ensure that you have configured an EIP.

Using kubectl to Access a Cluster

1. Download the kubeconfig.json file again after the SAN is modified.
   1. Log in to the CCE console and click the cluster name to access the cluster console.
   2. On the Overview page, locate the Connection Information area, click Configure next to kubectl. On the page displayed, download the configuration file.

2. Configure kubectl.
   1. Log in to your client and copy the kubeconfig.json file downloaded in 1 to the /home directory on your client.
   2. Configure the kubectl authentication file.

      cd /home
      mkdir -p $HOME/.kube
      mv -f kubeconfig.json $HOME/.kube/config
      
      

   3. Change the kubectl access mode and use the SAN to access the cluster.

      kubectl config use-context customSAN-0
      
      

      In the preceding command, customSAN-0 indicates the configuration name of the custom SAN. When multiple SANs are configured, each SAN is named with an incrementing number starting from 0, such as customSAN-0, customSAN-1, and more.

3. Run the following command on the client to check whether the client can access the cluster using kubectl:

   kubectl cluster-info    # Check the cluster information.
   
   

   If the following information is displayed, the client can access the cluster using kubectl:

   Kubernetes control plane is running at https://xx.xx.xx.xx:5443
   CoreDNS is running at https://xx.xx.xx.xx:5443/api/v1/namespaces/kube-system/services/coredns:dns/proxy
   To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
   
   

Using an X.509 Certificate to Access a Cluster

1. After the SAN is modified, download the X.509 certificate again.
   1. Log in to the CCE console and click the cluster name to access the cluster console.
   2. On the Overview page, locate the Connection Information area, and click Download next to X.509 certificate.
   3. In the Obtain Certificate dialog box displayed, select the certificate expiration time and download the X.509 certificate of the cluster as prompted.

2. Call Kubernetes native APIs using the cluster certificate.

   For example, run the curl command to call an API to obtain the pod information. In the following information, example.com:5443 indicates the custom SAN.

   curl --cacert ./ca.crt --cert ./client.crt --key ./client.key  https://example.com:5443/api/v1/namespaces/default/pods/
   
   

   If the following information is displayed, the X.509 certificate is correctly configured and the API Server of the cluster is running properly:

   {
     "kind": "PodList",
     "apiVersion": "v1",
   ...
   
   

   For more cluster APIs, see Kubernetes API.