kubeadm-certs: fix wrong info about admin.conf #48095

neolit123 · 2024-09-26T10:12:48Z

While the super-admin.conf change was introduced, looks like we forgot to update this particular section of the kubeadm-certs.md.

https://kubernetes.io/docs/reference/setup-tools/kubeadm/implementation-details/#generate-kubeconfig-files-for-control-plane-components

The above section already has the right info.

neolit123 · 2024-09-26T10:13:05Z

/cc @SataQiu @pacoxu for LGTM
/sig cluster-lifecycle

k8s-ci-robot · 2024-09-26T10:13:09Z

@neolit123: GitHub didn't allow me to request PR reviews from the following users: for, LGTM.

Note that only kubernetes members and repo collaborators can review this PR, and authors cannot review their own PRs.

In response to this:

/cc @SataQiu @pacoxu for LGTM
/sig cluster-lifecycle

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

neolit123 · 2024-09-26T10:13:13Z

/kind bug
/triage accepted

netlify · 2024-09-26T10:21:43Z

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`fa074af`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/66f5547f106bea00085dba30
😎 Deploy Preview	https://deploy-preview-48095--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

pacoxu

Should this be cherry-picked to 1.31 and 1.30? I am not familiar with website cherry pick policy.

Link to kubernetes/kubeadm#2414.

/lgtm

k8s-ci-robot · 2024-09-26T10:36:56Z

LGTM label has been added.

Git tree hash: 355f73e373d5419f1bd3a67ea9963efacc476f35

SataQiu

/lgtm

sftim

/lgtm

But, I'd use a callout for the security warning.

sftim · 2024-09-26T10:51:18Z

content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md

+is a kubeadm managed group bound to the
+[`cluster-admin`]((/docs/reference/access-authn-authz/rbac/#user-facing-roles)) ClusterRole.
+
+Sharing the `super-admin.conf` or `admin.conf` with additional users is **not recommended**!


Suggested change

Sharing the `super-admin.conf` or `admin.conf` with additional users is **not recommended**!

{{< warning >}}

Avoid sharing the `super-admin.conf` or `admin.conf` files; instead, create least privileged access

- even for people who work as administrators - and use that least privilege alternative for anything

other than break-glass (emergency) access.

{{< /warning >}}

content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md

neolit123 · 2024-09-26T11:20:46Z

@sftim updated.

@pacoxu

Should this be cherry-picked to 1.31 and 1.30? I am not familiar with website cherry pick policy.

me neither.

content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md

dipesh-rawat · 2024-09-26T12:31:01Z

Should this be cherry-picked to 1.31 and 1.30? I am not familiar with website cherry pick policy.

This PR will update the doc for the current latest release (1.31) since it's targeting the main branch. If we also need to update the doc for v1.30 or any other release, we’ll need to create a separate pull request targeting the release-1.30 or release-1.xx branch.

While the super-admin.conf change was introduced, looks like we forgot to update this particular section of the kubeadm-certs.md. https://kubernetes.io/docs/reference/setup-tools/kubeadm/implementation-details/#generate-kubeconfig-files-for-control-plane-components The above section already has the right info.

neolit123 · 2024-09-26T12:33:41Z

Should this be cherry-picked to 1.31 and 1.30? I am not familiar with website cherry pick policy.

This PR will update the doc for the current latest release (1.31) since it's targeting the main branch. If we also need to update the doc for v1.30 or any other release, we’ll need to create a separate pull request targeting the release-1.30 or release-1.xx branch.

ok, once this merges i can send cherry pick for release-1.30
EDIT: and 1.29
kubernetes/kubernetes#121305

dipesh-rawat

/approve

k8s-ci-robot · 2024-09-26T12:45:56Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dipesh-rawat, pacoxu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~content/en/docs/OWNERS~~ [dipesh-rawat]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

neolit123 · 2024-09-26T13:03:08Z

looking for another LGTM.
thanks

pacoxu · 2024-09-26T13:06:45Z

/lgtm
since Tim's comment is addressed.

k8s-ci-robot · 2024-09-26T13:06:52Z

LGTM label has been added.

Git tree hash: 6843dcb0cac2f7440e9329958b21cc49cf3eb32a

neolit123 · 2024-09-26T14:31:30Z

backports

tengqm · 2024-09-26T11:56:42Z

content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md

+`Subject: O = kubeadm:cluster-admins, CN = kubernetes-admin`. `kubeadm:cluster-admins`
+is a group logically belonging to kubeadm. If your cluster uses RBAC


What does this mean? kubeadm is a CLI tool. Why there is a group belonging to a tool?

kubeadm:cluster-admins is a group logically belonging to kubeadm.

Some design details in https://github.com/kubernetes/enhancements/tree/master/keps/sig-cluster-lifecycle/kubeadm/4214-separate-super-user-kubeconfig#proposal.

The "kubeadm:cluster-admins is a group logically belonging to kubeadm" statement is confusing. You can say that this group is created and used by kubeadm. Having a group belonging to a CLI tool is confusing.

group is a term from rbac.

tengqm · 2024-09-26T21:51:32Z

content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md

+{{< warning >}}
+Avoid sharing the `super-admin.conf` or `admin.conf` files. Instead, create least
+privileged access even for people who work as administrators and use that least
+privilege alternative for anything other than break-glass (emergency) access.


Okay. Please state what "least privilege alternative" means. Or else, this suggestion is not actionable.

@sftim suggested this change.

k8s-ci-robot requested a review from drewhagen September 26, 2024 10:12

k8s-ci-robot added the language/en Issues or PRs related to English language label Sep 26, 2024

k8s-ci-robot requested a review from mickeyboxell September 26, 2024 10:12

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Sep 26, 2024

k8s-ci-robot requested a review from SataQiu September 26, 2024 10:13

k8s-ci-robot added the sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle. label Sep 26, 2024

k8s-ci-robot requested a review from pacoxu September 26, 2024 10:13

k8s-ci-robot added kind/bug Categorizes issue or PR as related to a bug. triage/accepted Indicates an issue or PR is ready to be actively worked on. labels Sep 26, 2024

pacoxu approved these changes Sep 26, 2024

View reviewed changes

k8s-ci-robot assigned pacoxu Sep 26, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 26, 2024

SataQiu reviewed Sep 26, 2024

View reviewed changes

k8s-ci-robot assigned SataQiu Sep 26, 2024

sftim reviewed Sep 26, 2024

View reviewed changes

k8s-ci-robot assigned sftim Sep 26, 2024

neolit123 force-pushed the 1.32-fix-wrong-info-about-admin.conf branch from 9e90107 to a9bd810 Compare September 26, 2024 11:19

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 26, 2024

k8s-ci-robot requested review from pacoxu, SataQiu and sftim September 26, 2024 11:19

dipesh-rawat reviewed Sep 26, 2024

View reviewed changes

content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md Outdated Show resolved Hide resolved

neolit123 force-pushed the 1.32-fix-wrong-info-about-admin.conf branch from a9bd810 to fa074af Compare September 26, 2024 12:33

dipesh-rawat reviewed Sep 26, 2024

View reviewed changes

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 26, 2024

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Sep 26, 2024

k8s-ci-robot merged commit 3e5e73e into kubernetes:main Sep 26, 2024
6 checks passed

This was referenced Sep 26, 2024

kubeadm-certs: fix wrong info about admin.conf #48097

Merged

kubeadm-certs: fix wrong info about admin.conf #48098

Merged

tengqm reviewed Sep 26, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

kubeadm-certs: fix wrong info about admin.conf #48095

kubeadm-certs: fix wrong info about admin.conf #48095

neolit123 commented Sep 26, 2024

neolit123 commented Sep 26, 2024

k8s-ci-robot commented Sep 26, 2024

neolit123 commented Sep 26, 2024

netlify bot commented Sep 26, 2024 •

edited

Loading

pacoxu left a comment •

edited

Loading

k8s-ci-robot commented Sep 26, 2024

SataQiu left a comment

sftim left a comment

sftim Sep 26, 2024 •

edited

Loading

neolit123 Sep 26, 2024

neolit123 commented Sep 26, 2024

dipesh-rawat commented Sep 26, 2024

neolit123 commented Sep 26, 2024 •

edited

Loading

dipesh-rawat left a comment

k8s-ci-robot commented Sep 26, 2024

neolit123 commented Sep 26, 2024

pacoxu commented Sep 26, 2024

k8s-ci-robot commented Sep 26, 2024

neolit123 commented Sep 26, 2024 •

edited

Loading

tengqm Sep 26, 2024

pacoxu Sep 27, 2024

tengqm Sep 27, 2024

neolit123 Sep 27, 2024

tengqm Sep 26, 2024

neolit123 Sep 27, 2024

		`Subject: O = kubeadm:cluster-admins, CN = kubernetes-admin`. `kubeadm:cluster-admins`
		is a group logically belonging to kubeadm. If your cluster uses RBAC

kubeadm-certs: fix wrong info about admin.conf #48095

kubeadm-certs: fix wrong info about admin.conf #48095

Conversation

neolit123 commented Sep 26, 2024

neolit123 commented Sep 26, 2024

k8s-ci-robot commented Sep 26, 2024

neolit123 commented Sep 26, 2024

netlify bot commented Sep 26, 2024 • edited Loading

✅ Pull request preview available for checking

pacoxu left a comment • edited Loading

Choose a reason for hiding this comment

k8s-ci-robot commented Sep 26, 2024

SataQiu left a comment

Choose a reason for hiding this comment

sftim left a comment

Choose a reason for hiding this comment

sftim Sep 26, 2024 • edited Loading

Choose a reason for hiding this comment

neolit123 Sep 26, 2024

Choose a reason for hiding this comment

neolit123 commented Sep 26, 2024

dipesh-rawat commented Sep 26, 2024

neolit123 commented Sep 26, 2024 • edited Loading

dipesh-rawat left a comment

Choose a reason for hiding this comment

k8s-ci-robot commented Sep 26, 2024

neolit123 commented Sep 26, 2024

pacoxu commented Sep 26, 2024

k8s-ci-robot commented Sep 26, 2024

neolit123 commented Sep 26, 2024 • edited Loading

tengqm Sep 26, 2024

Choose a reason for hiding this comment

pacoxu Sep 27, 2024

Choose a reason for hiding this comment

tengqm Sep 27, 2024

Choose a reason for hiding this comment

neolit123 Sep 27, 2024

Choose a reason for hiding this comment

tengqm Sep 26, 2024

Choose a reason for hiding this comment

neolit123 Sep 27, 2024

Choose a reason for hiding this comment

netlify bot commented Sep 26, 2024 •

edited

Loading

pacoxu left a comment •

edited

Loading

sftim Sep 26, 2024 •

edited

Loading

neolit123 commented Sep 26, 2024 •

edited

Loading

neolit123 commented Sep 26, 2024 •

edited

Loading