Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 17119b9

Browse filesBrowse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #48401 from windsonsea/nodefor
Clean up best-practices: certificates and node-conformance
2 parents 6d4ef64 + 1d24167 commit 17119b9
Copy full SHA for 17119b9

File tree

Expand file treeCollapse file tree

2 files changed

+63
-55
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

2 files changed

+63
-55
lines changed
Open diff view settings
Collapse file

‎content/en/docs/setup/best-practices/certificates.md‎

Copy file name to clipboardExpand all lines: content/en/docs/setup/best-practices/certificates.md
+42-36Lines changed: 42 additions & 36 deletions
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -42,15 +42,19 @@ Kubernetes requires PKI for the following operations:
4242

4343
### Kubelet's server and client certificates
4444

45-
To establish a secure connection and authenticate itself to the kubelet, the API Server
46-
requires a client certificate and key pair.
45+
To establish a secure connection and authenticate itself to the kubelet, the API Server
46+
requires a client certificate and key pair.
4747

48-
In this scenario, there are two approaches for certificate usage:
49-
using shared certificates or separate certificates;
48+
In this scenario, there are two approaches for certificate usage:
5049

51-
* Shared Certificates: The kube-apiserver can utilize the same certificate and key pair it uses to authenticate its clients. This means that the existing certificates, such as `apiserver.crt` and `apiserver.key`, can be used for communicating with the kubelet servers.
50+
* Shared Certificates: The kube-apiserver can utilize the same certificate and key pair it uses
51+
to authenticate its clients. This means that the existing certificates, such as `apiserver.crt`
52+
and `apiserver.key`, can be used for communicating with the kubelet servers.
5253

53-
* Separate Certificates: Alternatively, the kube-apiserver can generate a new client certificate and key pair to authenticate its communication with the kubelet servers. In this case, a distinct certificate named `kubelet-client.crt` and its corresponding private key, `kubelet-client.key` are created.
54+
* Separate Certificates: Alternatively, the kube-apiserver can generate a new client certificate
55+
and key pair to authenticate its communication with the kubelet servers. In this case,
56+
a distinct certificate named `kubelet-client.crt` and its corresponding private key,
57+
`kubelet-client.key` are created.
5458

5559
{{< note >}}
5660
`front-proxy` certificates are required only if you run kube-proxy to support
@@ -80,7 +84,7 @@ multiple intermediate CAs, and delegate all further creation to Kubernetes itsel
8084

8185
Required CAs:
8286

83-
| path | Default CN | description |
87+
| Path | Default CN | Description |
8488
|------------------------|---------------------------|----------------------------------|
8589
| ca.crt,key | kubernetes-ca | Kubernetes general CA |
8690
| etcd/ca.crt,key | etcd-ca | For all etcd-related functions |
@@ -111,7 +115,7 @@ Required certificates:
111115
| kube-etcd-peer | etcd-ca | | server, client | `<hostname>`, `<Host_IP>`, `localhost`, `127.0.0.1` |
112116
| kube-etcd-healthcheck-client | etcd-ca | | client | |
113117
| kube-apiserver-etcd-client | etcd-ca | | client | |
114-
| kube-apiserver | kubernetes-ca | | server | `<hostname>`, `<Host_IP>`, `<advertise_IP>`, `[1]` |
118+
| kube-apiserver | kubernetes-ca | | server | `<hostname>`, `<Host_IP>`, `<advertise_IP>`[^1] |
115119
| kube-apiserver-kubelet-client | kubernetes-ca | system:masters | client | |
116120
| front-proxy-client | kubernetes-front-proxy-ca | | client | |
117121

@@ -121,7 +125,7 @@ a less privileged group can be used. kubeadm uses the `kubeadm:cluster-admins` g
121125
that purpose.
122126
{{< /note >}}
123127

124-
[1]: any other IP or DNS name you contact your cluster on (as used by [kubeadm](/docs/reference/setup-tools/kubeadm/)
128+
[^1]: any other IP or DNS name you contact your cluster on (as used by [kubeadm](/docs/reference/setup-tools/kubeadm/)
125129
the load balancer stable IP and/or DNS name, `kubernetes`, `kubernetes.default`, `kubernetes.default.svc`,
126130
`kubernetes.default.svc.cluster`, `kubernetes.default.svc.cluster.local`)
127131

@@ -155,22 +159,22 @@ For kubeadm users only:
155159
Certificates should be placed in a recommended path (as used by [kubeadm](/docs/reference/setup-tools/kubeadm/)).
156160
Paths should be specified using the given argument regardless of location.
157161

158-
| Default CN | recommended key path | recommended cert path | command | key argument | cert argument |
159-
|------------------------------|------------------------------|-----------------------------|-------------------------|------------------------------|-------------------------------------------|
160-
| etcd-ca | etcd/ca.key | etcd/ca.crt | kube-apiserver | | --etcd-cafile |
161-
| kube-apiserver-etcd-client | apiserver-etcd-client.key | apiserver-etcd-client.crt | kube-apiserver | --etcd-keyfile | --etcd-certfile |
162-
| kubernetes-ca | ca.key | ca.crt | kube-apiserver | | --client-ca-file |
163-
| kubernetes-ca | ca.key | ca.crt | kube-controller-manager | --cluster-signing-key-file | --client-ca-file, --root-ca-file, --cluster-signing-cert-file |
164-
| kube-apiserver | apiserver.key | apiserver.crt | kube-apiserver | --tls-private-key-file | --tls-cert-file |
165-
| kube-apiserver-kubelet-client| apiserver-kubelet-client.key | apiserver-kubelet-client.crt| kube-apiserver | --kubelet-client-key | --kubelet-client-certificate |
166-
| front-proxy-ca | front-proxy-ca.key | front-proxy-ca.crt | kube-apiserver | | --requestheader-client-ca-file |
167-
| front-proxy-ca | front-proxy-ca.key | front-proxy-ca.crt | kube-controller-manager | | --requestheader-client-ca-file |
168-
| front-proxy-client | front-proxy-client.key | front-proxy-client.crt | kube-apiserver | --proxy-client-key-file | --proxy-client-cert-file |
169-
| etcd-ca | etcd/ca.key | etcd/ca.crt | etcd | | --trusted-ca-file, --peer-trusted-ca-file |
170-
| kube-etcd | etcd/server.key | etcd/server.crt | etcd | --key-file | --cert-file |
171-
| kube-etcd-peer | etcd/peer.key | etcd/peer.crt | etcd | --peer-key-file | --peer-cert-file |
172-
| etcd-ca | | etcd/ca.crt | etcdctl | | --cacert |
173-
| kube-etcd-healthcheck-client | etcd/healthcheck-client.key | etcd/healthcheck-client.crt | etcdctl | --key | --cert |
162+
| DefaultCN | recommendedkeypath | recommendedcertpath | command | keyargument | certargument |
163+
| --------- | ------------------ | ------------------- | ------- | ----------- | ------------ |
164+
| etcd-ca | etcd/ca.key | etcd/ca.crt | kube-apiserver | | --etcd-cafile |
165+
| kube-apiserver-etcd-client | apiserver-etcd-client.key | apiserver-etcd-client.crt | kube-apiserver | --etcd-keyfile | --etcd-certfile |
166+
| kubernetes-ca | ca.key | ca.crt | kube-apiserver | | --client-ca-file |
167+
| kubernetes-ca | ca.key | ca.crt | kube-controller-manager | --cluster-signing-key-file | --client-ca-file,--root-ca-file,--cluster-signing-cert-file |
168+
| kube-apiserver | apiserver.key | apiserver.crt| kube-apiserver | --tls-private-key-file | --tls-cert-file |
169+
| kube-apiserver-kubelet-client | apiserver-kubelet-client.key | apiserver-kubelet-client.crt | kube-apiserver | --kubelet-client-key | --kubelet-client-certificate |
170+
| front-proxy-ca | front-proxy-ca.key | front-proxy-ca.crt | kube-apiserver | | --requestheader-client-ca-file |
171+
| front-proxy-ca | front-proxy-ca.key | front-proxy-ca.crt | kube-controller-manager | | --requestheader-client-ca-file |
172+
| front-proxy-client | front-proxy-client.key | front-proxy-client.crt | kube-apiserver | --proxy-client-key-file | --proxy-client-cert-file |
173+
| etcd-ca | etcd/ca.key | etcd/ca.crt | etcd | | --trusted-ca-file,--peer-trusted-ca-file |
174+
| kube-etcd | etcd/server.key | etcd/server.crt | etcd | --key-file | --cert-file |
175+
| kube-etcd-peer | etcd/peer.key | etcd/peer.crt | etcd | --peer-key-file | --peer-cert-file |
176+
| etcd-ca| | etcd/ca.crt | etcdctl | | --cacert |
177+
| kube-etcd-healthcheck-client | etcd/healthcheck-client.key | etcd/healthcheck-client.crt | etcdctl | --key | --cert |
174178

175179
Same considerations apply for the service account key pair:
176180

@@ -206,11 +210,12 @@ you need to provide if you are generating all of your own keys and certificates:
206210
/etc/kubernetes/pki/sa.key
207211
/etc/kubernetes/pki/sa.pub
208212
```
213+
209214
## Configure certificates for user accounts
210215

211-
You must manually configure these administrator account and service accounts:
216+
You must manually configure these administrator accounts and service accounts:
212217

213-
| filename | credential name | Default CN | O (in Subject) |
218+
| Filename | Credential name | Default CN | O (in Subject) |
214219
|-------------------------|----------------------------|-------------------------------------|------------------------|
215220
| admin.conf | default-admin | kubernetes-admin | `<admin-group>` |
216221
| super-admin.conf | default-super-admin | kubernetes-super-admin | system:masters |
@@ -240,20 +245,21 @@ Another is in `super-admin.conf` that has `Subject: O = system:masters, CN = kub
240245
This file is generated only on the node where `kubeadm init` was called.
241246
{{< /note >}}
242247

243-
1. For each config, generate an x509 cert/key pair with the given CN and O.
248+
1. For each configuration, generate an x509 certificate/key pair with the
249+
given Common Name (CN) and Organization (O).
244250

245-
1. Run `kubectl` as follows for each config:
251+
1. Run `kubectl` as follows for each configuration:
246252

247-
```
248-
KUBECONFIG=<filename> kubectl config set-cluster default-cluster --server=https://<host ip>:6443 --certificate-authority <path-to-kubernetes-ca> --embed-certs
249-
KUBECONFIG=<filename> kubectl config set-credentials <credential-name> --client-key <path-to-key>.pem --client-certificate <path-to-cert>.pem --embed-certs
250-
KUBECONFIG=<filename> kubectl config set-context default-system --cluster default-cluster --user <credential-name>
251-
KUBECONFIG=<filename> kubectl config use-context default-system
252-
```
253+
```
254+
KUBECONFIG=<filename> kubectl config set-cluster default-cluster --server=https://<host ip>:6443 --certificate-authority <path-to-kubernetes-ca> --embed-certs
255+
KUBECONFIG=<filename> kubectl config set-credentials <credential-name> --client-key <path-to-key>.pem --client-certificate <path-to-cert>.pem --embed-certs
256+
KUBECONFIG=<filename> kubectl config set-context default-system --cluster default-cluster --user <credential-name>
257+
KUBECONFIG=<filename> kubectl config use-context default-system
258+
```
253259

254260
These files are used as follows:
255261

256-
| filename | command | comment |
262+
| Filename | Command | Comment |
257263
|-------------------------|-------------------------|-----------------------------------------------------------------------|
258264
| admin.conf | kubectl | Configures administrator user for the cluster |
259265
| super-admin.conf | kubectl | Configures super administrator user for the cluster |
Collapse file

‎content/en/docs/setup/best-practices/node-conformance.md‎

Copy file name to clipboardExpand all lines: content/en/docs/setup/best-practices/node-conformance.md
+21-19Lines changed: 21 additions & 19 deletions
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ title: Validate node setup
55
weight: 30
66
---
77

8-
98
## Node Conformance Test
109

1110
*Node conformance test* is a containerized test framework that provides a system
@@ -19,40 +18,42 @@ To run node conformance test, a node must satisfy the same prerequisites as a
1918
standard Kubernetes node. At a minimum, the node should have the following
2019
daemons installed:
2120

22-
* CRI-compatible container runtimes such as Docker, Containerd and CRI-O
23-
* Kubelet
21+
* CRI-compatible container runtimes such as Docker, containerd and CRI-O
22+
* kubelet
2423

2524
## Running Node Conformance Test
2625

2726
To run the node conformance test, perform the following steps:
27+
2828
1. Work out the value of the `--kubeconfig` option for the kubelet; for example:
2929
`--kubeconfig=/var/lib/kubelet/config.yaml`.
3030
Because the test framework starts a local control plane to test the kubelet,
3131
use `http://localhost:8080` as the URL of the API server.
3232
There are some other kubelet command line parameters you may want to use:
33-
* `--cloud-provider`: If you are using `--cloud-provider=gce`, you should
34-
remove the flag to run the test.
33+
34+
* `--cloud-provider`: If you are using `--cloud-provider=gce`, you should
35+
remove the flag to run the test.
3536

36-
2. Run the node conformance test with command:
37+
1. Run the node conformance test with command:
3738

38-
```shell
39-
# $CONFIG_DIR is the pod manifest path of your Kubelet.
40-
# $LOG_DIR is the test output path.
41-
sudo docker run -it --rm --privileged --net=host \
42-
-v /:/rootfs -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \
43-
registry.k8s.io/node-test:0.2
44-
```
39+
```shell
40+
# $CONFIG_DIR is the pod manifest path of your kubelet.
41+
# $LOG_DIR is the test output path.
42+
sudo docker run -it --rm --privileged --net=host \
43+
-v /:/rootfs -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \
44+
registry.k8s.io/node-test:0.2
45+
```
4546

4647
## Running Node Conformance Test for Other Architectures
4748

4849
Kubernetes also provides node conformance test docker images for other
4950
architectures:
5051

51-
Arch | Image |
52-
--------|:-----------------:|
53-
amd64 | node-test-amd64 |
54-
arm | node-test-arm |
55-
arm64 | node-test-arm64 |
52+
| Arch | Image |
53+
|--------|:-----------------:|
54+
| amd64 | node-test-amd64 |
55+
| arm | node-test-arm |
56+
| arm64 | node-test-arm64 |
5657

5758
## Running Selected Test
5859

@@ -76,7 +77,8 @@ sudo docker run -it --rm --privileged --net=host \
7677
registry.k8s.io/node-test:0.2
7778
```
7879

79-
Node conformance test is a containerized version of [node e2e test](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-node/e2e-node-tests.md).
80+
Node conformance test is a containerized version of
81+
[node e2e test](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-node/e2e-node-tests.md).
8082
By default, it runs all conformance tests.
8183

8284
Theoretically, you can run any node e2e test if you configure the container and

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.