Skip to content

Add remote support for SSH and TLS docker contexts #20981

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 8 commits into
base: master
Choose a base branch
from
Open

Add remote support for SSH and TLS docker contexts #20981

wants to merge 8 commits into from

Conversation

einyx
Copy link

@einyx einyx commented Jun 24, 2025 •
edited
Loading

This PR extends the existing remote Docker context support to handle TLS-secured Docker daemons, enabling minikube to work with both SSH and TLS remote Docker contexts.

  1. TLS Certificate Management (pkg/drivers/kic/oci/context.go):

    • Loads TLS certificates from Docker's context store
    • Creates temporary directories with proper permissions (0600) for certificate files
    • Manages certificate lifecycle with automatic cleanup on exit

  2. Connection Routing (pkg/drivers/kic/kic.go):

    • SSH contexts use localhost (tunneled connection)
    • TLS contexts use the actual remote host address

  3. Environment Configuration:

    • Sets DOCKER_TLS_VERIFY=1 and DOCKER_CERT_PATH for TLS contexts
    • Maintains compatibility with existing SSH tunnel behavior

Testing:

  • Tested with SSH Docker contexts
  • Tested with TLS-secured Docker daemons on remote Linux hosts
  • Verified certificate cleanup on minikube exit
  • Cross-platform testing: macOS (ARM64) → Linux (x86_64) with TLS

@k8s-ci-robot k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 24, 2025
@linux-foundation-easycla Linux Foundation: EasyCLA
Copy link

linux-foundation-easycla bot commented Jun 24, 2025 •
edited
Loading

CLA Signed

The committers listed above are authorized under a signed CLA.

@k8s-ci-robot k8s-ci-robot added the cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. label Jun 24, 2025
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: einyx
Once this PR has been reviewed and has the lgtm label, please assign spowelljr for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot
Copy link
Contributor

Welcome @einyx!

It looks like this is your first PR to kubernetes/minikube 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/minikube has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

@k8s-ci-robot k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jun 24, 2025
@k8s-ci-robot
Copy link
Contributor

Hi @einyx. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Jun 24, 2025
@minikube-bot
Copy link
Collaborator

Can one of the admins verify this patch?

@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Jun 24, 2025
@einyx einyx force-pushed the main branch 7 times, most recently from 96de3d5 to a1ec633 Compare June 25, 2025 00:09
@medyagh
Copy link
Member

medyagh commented Jun 25, 2025

@einyx interessting PR ! I am curious do you mind sharing what are your use cases, why did you think about using a remote context ?

@einyx
Copy link
Author

einyx commented Jun 26, 2025 •
edited
Loading

Hi @medyagh!

The motivation here is that selfishly I frequently work across multiple machines,
mostly a decent Linux workstation and a more modests Mac Mini and Macbook.

Since my Linux workstation has significantly more resources (CPU, RAM, etc.),
I use it as a remote docker host for resource-intensive builds, distcc and generally for compute.

Use cases this enables:

  • Developers on lightweight laptops can provision minikube clusters on more powerful remote machines
  • Teams can share development infrastructure while maintaining isolated minikube environments
  • I use Terraform to interact with minikube, which this makes even more convenient for extra compute

Attached log from latest minikube run over TLS docker context:
log1.txt

Happy to discuss any concerns or alternative approaches!

dependabot bot added 2 commits June 26, 2025 01:32
@dependabot
Build(deps): Bump the npm_and_yarn group across 1 directory with 3 up…
ad1c5a6 
…dates

Bumps the npm_and_yarn group with 3 updates in the /site directory: [postcss](https://github.com/postcss/postcss), [autoprefixer](https://github.com/postcss/autoprefixer) and [postcss-cli](https://github.com/postcss/postcss-cli).


Updates `postcss` from 7.0.39 to 8.5.6
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@7.0.39...8.5.6)

Updates `autoprefixer` from 9.8.8 to 10.4.21
- [Release notes](https://github.com/postcss/autoprefixer/releases)
- [Changelog](https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md)
- [Commits](postcss/autoprefixer@9.8.8...10.4.21)

Updates `postcss-cli` from 7.1.2 to 11.0.1
- [Release notes](https://github.com/postcss/postcss-cli/releases)
- [Changelog](https://github.com/postcss/postcss-cli/blob/master/CHANGELOG.md)
- [Commits](postcss/postcss-cli@7.1.2...11.0.1)

---
updated-dependencies:
- dependency-name: postcss
  dependency-version: 8.5.6
  dependency-type: indirect
  dependency-group: npm_and_yarn
- dependency-name: autoprefixer
  dependency-version: 10.4.21
  dependency-type: direct:development
  dependency-group: npm_and_yarn
- dependency-name: postcss-cli
  dependency-version: 11.0.1
  dependency-type: direct:development
  dependency-group: npm_and_yarn
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Build(deps): Bump google.golang.org/grpc
3a30804 
Bumps the go_modules group with 1 update in the /hack/jenkins/test-flake-chart/report_flakes directory: [google.golang.org/grpc](https://github.com/grpc/grpc-go).


Updates `google.golang.org/grpc` from 1.64.0 to 1.64.1
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.64.0...v1.64.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.64.1
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
@einyx einyx marked this pull request as ready for review June 26, 2025 09:26
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 26, 2025
@k8s-ci-robot k8s-ci-robot requested a review from prezha June 26, 2025 09:26
@spowelljr spowelljr removed their request for review June 26, 2025 23:48
einyx added 3 commits June 28, 2025 12:09
@einyx
Merge branch 'kubernetes:master' into main
61f0f9c
@einyx
Merge pull request #7 from einyx/dependabot/go_modules/hack/jenkins/t…
4fe03d6 
…est-flake-chart/report_flakes/go_modules-00bc3d2421

Build(deps): Bump google.golang.org/grpc from 1.64.0 to 1.64.1 in /hack/jenkins/test-flake-chart/report_flakes in the go_modules group across 1 directory
@einyx
Merge pull request #6 from einyx/dependabot/npm_and_yarn/site/npm_and…
b497115 
…_yarn-337413cf79

Build(deps): Bump the npm_and_yarn group across 1 directory with 3 updates
@einyx
Copy link
Author

einyx commented Jun 28, 2025 •
edited
Loading

@medyagh can I help facilitating this? I know this has been mentioned in a few issues before
#13950 #17868 #13303 #15604

@einyx einyx mentioned this pull request Jun 28, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@medyagh medyagh Awaiting requested review from medyagh

@prezha prezha Awaiting requested review from prezha

Assignees
No one assigned
Labels
cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@einyx @k8s-ci-robot @minikube-bot @medyagh