From 669322a78c1643188d21591b977d07cab13219af Mon Sep 17 00:00:00 2001 From: "Lubomir I. Ivanov" Date: Fri, 19 Mar 2021 17:48:29 +0200 Subject: [PATCH] kubeadm/create-cluster: add warning about admin.conf Add warning that the file must not be shared as it has super powers that cannot be revoked. --- .../tools/kubeadm/create-cluster-kubeadm.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md b/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md index a9b37e81678b5..565c9ab84642c 100644 --- a/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md +++ b/content/en/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm.md @@ -187,6 +187,13 @@ Alternatively, if you are the `root` user, you can run: export KUBECONFIG=/etc/kubernetes/admin.conf ``` +{{< warning >}} +Kubeadm signs the certificate in the `admin.conf` to have `Subject: O = system:masters, CN = kubernetes-admin`. +`system:masters` is a break-glass, super user group that bypasses the authorization layer (e.g. RBAC). +Do not share the `admin.conf` file with anyone and instead grant users custom permissions by generating +them a kubeconfig file using the `kubeadm kubeconfig user` command. +{{< /warning >}} + Make a record of the `kubeadm join` command that `kubeadm init` outputs. You need this command to [join nodes to your cluster](#join-nodes).