Kubelet / Master Authentication Options #2831

gambol99 · 2017-06-29T12:32:30Z

adding the options to permit adjusting the cluster to use auth on the kubelet
for testing i've used kubelet-client-certificate and kubelet-client-key to /srv/kubernetes/server.{cert,key} and setting the --client-ca-file on the node kubelet to /srv/kubernetes/ca.crt (tested as working).
note i'm not enforcing anything i.e. the user has to edit the cluster and apply the configuration on the kubelet and kubeAPIServer in the cluster spec

This change is

- adding the options to permit adjusting the cluster to use auth on the kubelet - for testing i've used kubelet-client-certificate and kubelet-client-key to /srv/kubernetes/server.{cert,key} and setting the --client-ca-file on the node kubelet to /srv/kubernetes/ca.crt (tested as working). - note i'm not enforcing anything i.e. the user has to edit the cluster and apply the configuration on the kubelet and kubeAPIServer in the cluster spec

k8s-ci-robot · 2017-06-29T12:32:32Z

Thanks for your pull request. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please follow instructions at https://github.com/kubernetes/kubernetes/wiki/CLA-FAQ to sign the CLA.

It may take a couple minutes for the CLA signature to be fully registered; after that, please reply here with a new comment and we'll verify. Thanks.

If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
If you signed the CLA as a corporation, please sign in with your organization's credentials at https://identity.linuxfoundation.org/projects/cncf to be authorized.
If you have done the above and are still having issues with the CLA being reported as unsigned, please email the CNCF helpdesk: helpdesk@rt.linuxfoundation.org

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

k8s-ci-robot · 2017-06-29T12:32:38Z

Hi @gambol99. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

gambol99 · 2017-06-29T12:52:00Z

I do believe these should be default settings, but was happy to leave that to another PR and simply provide the options to change here

chrislovecnm · 2017-06-29T21:36:20Z

@k8s-bot ok to test

justinsb

lgtm

justinsb · 2017-07-01T16:22:12Z

Thanks @gambol99

A while back options to permit secure kube-apiserver to kubelet api was kubernetes#2831 using the server.cert and server.key as testing grouns. This PR formalizes the options and generates a client certificate on their behalf (note, the server{.cert,key} can no longer be used post 1.7 as the certificate usage is checked i.e. it's not using a client cert). The users now only need to add anonymousAuth: false to enable secure api to kubelet. I'd like to make this default to all new builds i'm not sure where to place it. - updated the security.md to reflect the changes - issue a new client kubelet-api certificate used to secure authorize comms between api and kubelet - fixed any formatting issues i came across on the journey

…as [PR2381](kubernetes#2831) using the server.cert and server.key as testing grounds. This PR formalizes the options and generates a client certificate on their behalf (note, the server{.cert,key} can no longer be used post 1.7 as the certificate usage is checked i.e. it's not using a client cert). The users now only need to add anonymousAuth: false to enable secure api to kubelet. I'd like to make this default to all new builds i'm not sure where to place it. - updated the security.md to reflect the changes - issue a new client kubelet-api certificate used to secure authorize comms between api and kubelet - fixed any formatting issues i came across on the journey

A while back options to permit secure kube-apiserver to kubelet api was kubernetes#2831 using the server.cert and server.key as testing grouns. This PR formalizes the options and generates a client certificate on their behalf (note, the server{.cert,key} can no longer be used post 1.7 as the certificate usage is checked i.e. it's not using a client cert). The users now only need to add anonymousAuth: false to enable secure api to kubelet. I'd like to make this default to all new builds i'm not sure where to place it. - updated the security.md to reflect the changes - issue a new client kubelet-api certificate used to secure authorize comms between api and kubelet - fixed any formatting issues i came across on the journey

Automatic merge from submit-queue Kubelet API Certificate A while back options to permit secure kube-apiserver to kubelet api was [PR2381](#2831) using the server.cert and server.key as testing grounds. This PR formalizes the options and generates a client certificate on their behalf (note, the server{.cert,key} can no longer be used post 1.7 as the certificate usage is checked i.e. it's not using a client cert). The users now only need to add anonymousAuth: false to enable secure api to kubelet. I'd like to make this default to all new builds i'm not sure where to place it. - updated the security.md to reflect the changes - issue a new client kubelet-api certificate used to secure authorize comms between api and kubelet - fixed any formatting issues i came across on the journey

A while back options to permit secure kube-apiserver to kubelet api was kubernetes#2831 using the server.cert and server.key as testing grouns. This PR formalizes the options and generates a client certificate on their behalf (note, the server{.cert,key} can no longer be used post 1.7 as the certificate usage is checked i.e. it's not using a client cert). The users now only need to add anonymousAuth: false to enable secure api to kubelet. I'd like to make this default to all new builds i'm not sure where to place it. - updated the security.md to reflect the changes - issue a new client kubelet-api certificate used to secure authorize comms between api and kubelet - fixed any formatting issues i came across on the journey

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jun 29, 2017

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Jun 29, 2017

gambol99 changed the title ~~Kubelet / Master Authentication~~ Kubelet / Master Authentication Options Jun 29, 2017

k8s-ci-robot removed the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Jun 29, 2017

justinsb approved these changes Jul 1, 2017

View reviewed changes

justinsb merged commit bd943e6 into kubernetes:master Jul 1, 2017

gambol99 deleted the kubelet_auth branch July 28, 2017 00:01

gambol99 mentioned this pull request Jul 31, 2017

Secure master -> kubelet configuration #2720

Closed

gambol99 mentioned this pull request Aug 2, 2017

Kubelet API Certificate #3125

Merged

gambol99 mentioned this pull request Aug 3, 2017

Customize Kops Platform UKHomeOffice/kops#1

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Kubelet / Master Authentication Options #2831

Kubelet / Master Authentication Options #2831

gambol99 commented Jun 29, 2017 •

edited by k8s-reviewable

Loading

k8s-ci-robot commented Jun 29, 2017

k8s-ci-robot commented Jun 29, 2017

gambol99 commented Jun 29, 2017 •

edited

Loading

chrislovecnm commented Jun 29, 2017

justinsb left a comment

justinsb commented Jul 1, 2017

Kubelet / Master Authentication Options #2831

Kubelet / Master Authentication Options #2831

Conversation

gambol99 commented Jun 29, 2017 • edited by k8s-reviewable Loading

k8s-ci-robot commented Jun 29, 2017

k8s-ci-robot commented Jun 29, 2017

gambol99 commented Jun 29, 2017 • edited Loading

chrislovecnm commented Jun 29, 2017

justinsb left a comment

Choose a reason for hiding this comment

justinsb commented Jul 1, 2017

gambol99 commented Jun 29, 2017 •

edited by k8s-reviewable

Loading

gambol99 commented Jun 29, 2017 •

edited

Loading