☸️Kubernetes

This topic describes how to add and configure P0’s Kubernetes integration so users can use P0 to grant access to a Kubernetes cluster.

Prerequisites

Ensure you have the following before continuing:

  • Access to an existing Amazon Web Services (AWS), Azure, or Google Cloud service with a Kubernetes cluster.

  • A command-line application such as:

    • Standard local terminal application that supports Secure Shell (SSH) (e.g., Terminal, Command, PowerShell, or Bash)

    • Cloud service-specific command-line (CLI) shell (AWS CLI, Azure CLI, or Google Cloud)

  • kubectl command-line tool

  • jq JSON processor

Add the Kubernetes Cluster Integration

To add the Kubernetes Cluster integration to the P0 application:

  1. Open p0.app in your browser and log in.

  2. Select Integrations, navigate to the Resources section, and click Kubernetes.

  3. Click IAM management.

  4. On the IAM management screen, click + Add cluster.

  5. On the IAM management screen, populate the following fields to add the Kubernetes cluster to P0:

  • Cluster identifier: ID of the cluster. Use the ID in the Name field under Cluster basics:

  • Cluster endpoint: IP address of the cluster in the form of https://<address>:[port]. Navigate to Control Plane Networking and use the Public endpoint:

  • Cluster certification authority: Base64-encoded certificate data that verifies the API server’s authenticity. Click Show cluster certificate to display a popup where you can copy the certificate:

Ensure you copy the certificate including the -----BEGIN CERTIFICATION----- and -----END CERTIFICATE----- statements and paste it into the Cluster certification authority in P0.

  • Network Connectivity:

    • Public: Select this if the cluster's API is accessible directly over the Internet.

    • P0 Proxy: Select this if you are routing through P0’s reverse HTTPS proxy (used for private network setups).

  • Hosting: Select your cloud provider (e.g. Google Cloud) and enter the cluster details (e.g., GCP Project ID, GKE cluster name, and Location for Google Cloud).

  1. At the bottom of the IAM management screen, click Next.

  2. Open Google Cloud Shell (recommended) or a local shell, and run the following command to log into Google Cloud: gcloud auth login

  1. Return to P0’s IAM management screen and copy the kubectl commands provided

  1. Return to your shell, and paste the commands you just copied to enable P0’s admission controller. The output should look similar to the following:

namespace/p0-security created
serviceaccount/p0-service-account created
secret/p0-service-account-secret created
clusterrole.rbac.authorization.k8s.io/p0-service-role created
clusterrolebinding.rbac.authorization.k8s.io/p0-service-role-binding created
deployment.apps/p0-admission-controller created
service/p0-admission-controller created
validatingwebhookconfiguration.admissionregistration.k8s.io/p0-admission-controller created
  1. Return to the P0 IAM management screen, click Next, and copy the cluster token.

  1. In your shell, paste the command copied in the previous step to generate a token.

  2. Copy the resulting token from the shell, return to the P0 IAM management screen, and paste it into the Cluster token input field.

  3. Review the rest of the configuration and click Finish. P0 installs the integration and shows the cluster’s State as Installed once complete.

  4. To ensure your integration works see Requesting Access.

Congratulations, you have successfully integrated a Kubernetes cluster with P0 and can make access requests to it via P0’s Slack bot.

Last updated