Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow login to several k8s clusters with one action #42

Open
dive-deeper opened this issue Mar 1, 2024 · 0 comments
Open

Allow login to several k8s clusters with one action #42

dive-deeper opened this issue Mar 1, 2024 · 0 comments

Comments

@dive-deeper
Copy link

Description

When using the action auth-k8s one can specify the name of a single k8s cluster to connect to. This action works fine, however I need to connect to multiple clusters. The way I've found to do this is as follows:

      - name: Authorize against Teleport
        uses: teleport-actions/auth-k8s@v1
        with:
          proxy: <proxy-address>
          token: ${{ secrets.TELEPORT_TOKEN }}
          certificate-ttl: 15m
          kubernetes-cluster: cluster1
      - run: "echo ROOT_KUBECONFIG=$KUBECONFIG >> $GITHUB_ENV"

      - name: Authorize against Teleport
        uses: teleport-actions/auth-k8s@v1
        with:
          proxy: <proxy-address>
          token: ${{ secrets.TELEPORT_TOKEN }}
          certificate-ttl: 15m
          kubernetes-cluster: cluster2
      - run: "echo ROOT_KUBECONFIG=$ROOT_KUBECONFIG:$KUBECONFIG >> $GITHUB_ENV"
      - run: "echo KUBECONFIG=$ROOT_KUBECONFIG >> $GITHUB_ENV"

Which is ok for 2 clusters but I need to connect to 1-2 dozen of them, which definitely takes some time.
I tried using the action auth and then using tsh kube login, which is indeed successful, but when I execute any kubectl command it fails with the following error:

ERROR: access denied: identity is not allowed to reissue certificates
E0221 23:11:50.416446    1801 memcache.go:265] couldn't get current server API group list: Get "https://<teleport host>/api?timeout=32s": getting credentials: exec: executable /opt/hostedtoolcache/teleport/13.4.15-linux-amd64/x64/tsh failed with exit code 1

It would be nice if one could login to all allowed cluster for the identity, similar to tsh kube login all.

If this is possible already, it should be documented :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant