{"action":"created","issue":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/7307","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/7307/labels{/name}","comments_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/7307/comments","events_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/7307/events","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/7307","id":70793122,"number":7307,"title":"Make it easy to get client/server certs into chrome (or other browsers)","user":{"login":"lavalamp","id":647318,"avatar_url":"https://avatars.githubusercontent.com/u/647318?v=3","gravatar_id":"","url":"https://api.github.com/users/lavalamp","html_url":"https://github.com/lavalamp","followers_url":"https://api.github.com/users/lavalamp/followers","following_url":"https://api.github.com/users/lavalamp/following{/other_user}","gists_url":"https://api.github.com/users/lavalamp/gists{/gist_id}","starred_url":"https://api.github.com/users/lavalamp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lavalamp/subscriptions","organizations_url":"https://api.github.com/users/lavalamp/orgs","repos_url":"https://api.github.com/users/lavalamp/repos","events_url":"https://api.github.com/users/lavalamp/events{/privacy}","received_events_url":"https://api.github.com/users/lavalamp/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/priority/P1","name":"priority/P1","color":"eb6420"},{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/labels/team/UX","name":"team/UX","color":"d2b48c"}],"state":"open","locked":false,"assignee":{"login":"roberthbailey","id":7751204,"avatar_url":"https://avatars.githubusercontent.com/u/7751204?v=3","gravatar_id":"","url":"https://api.github.com/users/roberthbailey","html_url":"https://github.com/roberthbailey","followers_url":"https://api.github.com/users/roberthbailey/followers","following_url":"https://api.github.com/users/roberthbailey/following{/other_user}","gists_url":"https://api.github.com/users/roberthbailey/gists{/gist_id}","starred_url":"https://api.github.com/users/roberthbailey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/roberthbailey/subscriptions","organizations_url":"https://api.github.com/users/roberthbailey/orgs","repos_url":"https://api.github.com/users/roberthbailey/repos","events_url":"https://api.github.com/users/roberthbailey/events{/privacy}","received_events_url":"https://api.github.com/users/roberthbailey/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/milestones/6","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/milestones/v1.0","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/milestones/6/labels","id":969317,"number":6,"title":"v1.0","description":"Issues that need to be resolved for v1.0 of Kubernetes.","creator":{"login":"goltermann","id":9358478,"avatar_url":"https://avatars.githubusercontent.com/u/9358478?v=3","gravatar_id":"","url":"https://api.github.com/users/goltermann","html_url":"https://github.com/goltermann","followers_url":"https://api.github.com/users/goltermann/followers","following_url":"https://api.github.com/users/goltermann/following{/other_user}","gists_url":"https://api.github.com/users/goltermann/gists{/gist_id}","starred_url":"https://api.github.com/users/goltermann/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/goltermann/subscriptions","organizations_url":"https://api.github.com/users/goltermann/orgs","repos_url":"https://api.github.com/users/goltermann/repos","events_url":"https://api.github.com/users/goltermann/events{/privacy}","received_events_url":"https://api.github.com/users/goltermann/received_events","type":"User","site_admin":false},"open_issues":119,"closed_issues":215,"state":"open","created_at":"2015-02-06T20:27:16Z","updated_at":"2015-04-24T21:28:17Z","due_on":null,"closed_at":null},"comments":2,"created_at":"2015-04-24T21:03:25Z","updated_at":"2015-04-25T05:00:53Z","closed_at":null,"body":"It's pretty annoying to have to grab an extension to set a token header, likewise to use kubectl to proxy apiserver locally. Additionally, the old way with basic auth (and the header method) are easy to MITM. Therefore, let's do it right, and make it easy to get the ca and client certs imported into your browser.\r\n\r\nSetting as P1 because we just turned off the basic auth method."},"comment":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/comments/96130676","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/7307#issuecomment-96130676","issue_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/7307","id":96130676,"user":{"login":"roberthbailey","id":7751204,"avatar_url":"https://avatars.githubusercontent.com/u/7751204?v=3","gravatar_id":"","url":"https://api.github.com/users/roberthbailey","html_url":"https://github.com/roberthbailey","followers_url":"https://api.github.com/users/roberthbailey/followers","following_url":"https://api.github.com/users/roberthbailey/following{/other_user}","gists_url":"https://api.github.com/users/roberthbailey/gists{/gist_id}","starred_url":"https://api.github.com/users/roberthbailey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/roberthbailey/subscriptions","organizations_url":"https://api.github.com/users/roberthbailey/orgs","repos_url":"https://api.github.com/users/roberthbailey/repos","events_url":"https://api.github.com/users/roberthbailey/events{/privacy}","received_events_url":"https://api.github.com/users/roberthbailey/received_events","type":"User","site_admin":false},"created_at":"2015-04-25T05:00:53Z","updated_at":"2015-04-25T05:00:53Z","body":"Ok, I figured it out (for the mac at least -- will work on Linux next week). It isn't the most straightforward thing (so we need to make it simpler) but here's what you need to do: \r\n\r\nFetch cert files from the master. These are the same files that are fetched during cluster creation and stored in the `kubeconfig` file, but we want them un-embedded so it's easiest to just do it again: \r\n```\r\n$ gcloud compute copy-files --zone=<zone> root@<cluster-name>-master:/srv/kubernetes/{kubecfg.crt,kubecfg.key,ca.crt} .\r\n```\r\nImport the CA root into your keychain. This will ask you to trust the cert and will probably prompt you for your admin password. At this point you will be able to connect to the master without getting the ugly certificate warning in your web browser. \r\n\r\nGenerate a `pkcs12` file from the kubecfg cert/key pair. This is the format that you can import into the keychain that Chrome/Safari will use as a client cert:\r\n```\r\n$ openssl pkcs12 -export -clcerts -inkey kubecfg.key -in kubecfg.crt -out kubecfg.p12 -name \"kubecfg\"\r\n```\r\nThis will ask you for an export password. I tried leaving it blank and that prevented me from adding it to the Keychain so make sure you enter something for the password.\r\n\r\nAt this point I had to restart Chrome for it to find the client cert (otherwise it gave a 401 Unauthorized result) but Safari picked it up right away. "}}