Is there a proper way to enable front proxy tls for extension api server

Hi all! I’m trying to play with kubevirt on top of microk8s and need to enable

--proxy-client-cert-file=<path to aggregator proxy cert>
--proxy-client-key-file=<path to aggregator proxy key>

flags for kube api server. Have anyone advice how to generate cert and key to do it? Related issue https://github.com/kubevirt/kubevirt/issues/1126

[ktsakalozos]

Based on the comment https://github.com/kubevirt/kubevirt/issues/1126#issuecomment-396360167 we can append the following into /var/snap/microk8s/current/args/kube-apiserver :

--proxy-client-cert-file=${SNAP_DATA}/certs/server.crt
--proxy-client-key-file=${SNAP_DATA}/certs/server.key

Then do a MicroK8s restart:

microk8s.stop
microk8s.start

Wait for the pods to restart. Have a look at microk8s.kubectl get all --all-namespaces.

You will then be able to do a:

sudo ./virtctl  --kubeconfig /var/snap/microk8s/current/credentials/client.config start testvm
VM testvm was scheduled to start

Or put the kubeconfig in the default location:

> microk8s.kubectl config view --raw > ~/.kube/config
> ./virtctl start testvm
Error starting VirtualMachine the server rejected our request for an unknown reason
> ./virtctl stop testvm
VM testvm was scheduled to stop

[attila123]

Thanks @ktsakalozos Actually I was only looking for how to use virtctl with microk8s, so I only did the 2nd half of your comment (e.g. using --kubeconfig with virtctl and saving the kubeconfig from microk8s, these worked fine with current microk8s, kubevirt, virtctl versions).