Advanced configuration of Kubernetes connection type
Within Keeper Connection Manager, support for attaching to the consoles of Kubernetes containers is provided by the
kcm-libguac-client-kubernetespackage. Support for Kubernetes is not installed by the
@kcmpackage group, but is installed within the keeper/
guacdDocker image. If this package has not yet been installed, Kubernetes connections will not be functional, with guacd logging a warning noting the absence of needed protocol support:
guacd: WARNING: Support for protocol "kubernetes" is not installed
If such an error appears within the guacd logs, simply installing
kcm-libguac-client-kubernetesis sufficient to resolve the issue:
$ sudo yum install kcm-libguac-client-kubernetes
The guacd service does not need to be restarted for installation of Kubernetes support to take effect.
Keeper's Kubernetes support takes the form of a protocol implementation which allows Guacamole to attach to the consoles of Kubernetes containers using Kubernetes' REST API. As with SSH and telnet, Guacamole's Kubernetes support emulates a terminal on the server side which renders to the Guacamole client's display.
Support for attaching to Kubernetes containers is controlled through the use of several parameters. When a database like MySQL or PostgreSQL is used, these parameters are presented in a convenient web interface. If defining connections through another mechanism, such as through encrypted JSON or LDAP schema modifications, parameters are specified using their internal parameter names.
This document is intended to cover all supported parameters, grouped in the same way they are grouped within the web interface. The field headings which would appear in the web interface are provided for each parameter, along with each parameter's internal name and a thorough description of the behavior and legal values for that parameter.
Connecting to a Kubernetes server in order to attach to a container involves establishing a WebSocket connection with that server, and requires the server's hostname or IP address. Depending on the Kubernetes server, SSL/TLS may also be required for the connection.
Attaching to a particular Kubernetes container naturally required the name of the pod containing the container in question. By default, Guacamole will attach to the first container in the pod. If there are multiple containers in the pod, you may wish to also specify the container name.
If enabled, Kubernetes uses SSL/TLS for both encryption and authentication. Standard SSL/TLS client authentication requires both a client certificate and client key, which Guacamole will use to identify itself to the Kubernetes server.
Guacamole's Kubernetes support provides a display, but not in the same sense as a remote desktop protocol like VNC or RDP. The display is a terminal emulator, and thus provides options for configuring the font used and its size.
If selecting a different font for a Kubernetes connection, the chosen font must be installed on the server running guacd. It is the server that will handle rendering of characters to the terminal display, not the client.
Custom color schemes may be provided for the terminal emulator used by Kubernetes connections. Custom schemes mimic the format used by Xterm and consist of a semicolon-separated series of name-value pairs. Each name-value pair is separated by a colon and assigns a value to a color in the terminal emulator palette.
For example, to use blue text on white background by default, and change the red color to a purple shade, you would specify:
Legal color names are:
foreground" - the default foreground color.
background" - the default background color.
colorN" - the color at index N within the Xterm 256-color palette. For example, "color9" refers to the color at palette index 9, normally red.
Legal color values are:
- "rgb:RR/GG/BB" - a color in RGB format, with each component in hexadecimal. For example, "
rgb:ff/00/00" specifies the color red. Each hexadecimal component may be one to four digits, but the effective values are always zero-extended or truncated to two digits; for example, "
rgb:f0/80/00", and "
rgb:f0f/808/00f" all refer to the same effective color.
colorN" - the color currently assigned to index N within the Xterm 256-color palette. For example, "
color9" specifies the color currently assigned to palette index 9. Note that the current color value is used rather than a reference to that color. If the referenced color is changed later in the color scheme configuration, that new color value will not be reflected in this assignment.
In most cases, the default behavior of the Guacamole terminal emulator works without modification. However, when connecting to certain systems, the terminal behavior may need to be tweaked to allow it to operate properly. Guacamole's Kubernetes support provides parameters for controlling the control code sent for backspace.
The full, raw text content of Kubernetes sessions, including timing information, can be recorded automatically to a specified directory. This recording, also known as a "typescript", will be written to two files within the directory specified: one file contains the raw text data, and the other contains timing information. Where "
NAME" is the value provided for the typescript name, these files will be named "
NAME" and "
This format is compatible with the format used by the standard UNIX
scriptcommand, and can be replayed using
scriptreplay(if installed). For example, to replay a typescript called "
NAME", you would run:
$ scriptreplay NAME.timing NAME
Kubernetes sessions can be recorded graphically. These recordings take the form of Guacamole protocol dumps and are recorded automatically to a specified directory. Recordings can be subsequently played back using the Glyptodon Enterprise Session Recording Player application hosted at player.glyptodon.com (or using a local deployment of this application).