Update exec plugin docs with TLS credentials #8826

awly · 2018-05-30T22:13:19Z

kubernetes/kubernetes#61803 implements TLS client credential support for
1.11.

k8sio-netlify-preview-bot · 2018-05-30T22:13:22Z

Deploy preview for kubernetes-io-vnext-staging processing.

Built with commit 15a01ac

https://app.netlify.com/sites/kubernetes-io-vnext-staging/deploys/5b1ef852b13fb16b6ebdf089

awly · 2018-05-30T22:13:53Z

/milestone 1.11

awly · 2018-05-30T22:16:05Z

/assign @mistyhacks

liggitt · 2018-05-30T22:22:25Z

content/en/docs/reference/access-authn-authz/authentication.md

 ```json
 {
  "apiVersion": "client.authentication.k8s.io/v1alpha1",
  "kind": "ExecCredential",
  "status": {
    "token": "my-bearer-token"
+    "clientCertificateData": "certificate PEM blob",


make the examples look like

"clientCertificateData":"-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----", "clientKeyData":"-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"

to make it clear how the content is passed/encoded

liggitt · 2018-05-30T22:25:29Z

content/en/docs/reference/access-authn-authz/authentication.md

 Kubernetes API.

+TLS credentials and bearer token are not mutually exclusive. Output with only
+`clientCertificateData` or only `clientKeyData` is an error.


I'd structure this as a list of statements:

The returned status may contain token, clientCertificateData and clientKeyData, or all three

clientCertificateData and clientKeyData must be provided together

clientCertificateData may contain additional intermediate certificates to send to the server

liggitt · 2018-05-30T22:47:20Z

content/en/docs/reference/access-authn-authz/authentication.md

+- The returned status may contain `token`, `clientCertificateData` and
+  `clientKeyData`, or all three
+- `clientCertificateData` and `clientKeyData` must be provided together
+- `clientCertificateData` may contain additional inermediate certificates to


typo: inermediate

liggitt · 2018-05-30T22:47:38Z

just the typo, then LGTM

mdlinville

A couple feedback items, but I would like to do a copyedit on this when you have addressed all technical feedback. Please ping me when you're ready.

/hold

mdlinville · 2018-05-30T22:46:24Z

content/en/docs/reference/access-authn-authz/authentication.md

+- `clientCertificateData` and `clientKeyData` must be provided together
+- `clientCertificateData` may contain additional inermediate certificates to
+  send to the server
+
 ```json
 {
  "apiVersion": "client.authentication.k8s.io/v1alpha1",
  "kind": "ExecCredential",
  "status": {
    "token": "my-bearer-token"


Missing a , at the end of this line and that's breaking the JSON

mdlinville · 2018-05-30T22:46:50Z

content/en/docs/reference/access-authn-authz/authentication.md

-status code. Note that this caching is only for the duration of process and therefore the plugin 
-is triggered each time the tool using the plugin is invoked.
+Optionally, this output can include the expiry of the token formatted as a
+RFC3339 timestamp.  If an expiry is omitted, the bearer token and TLS


Nit: Don't use double spaces between sentences.

mdlinville · 2018-05-30T22:47:36Z

content/en/docs/reference/access-authn-authz/authentication.md


 ```json
 {
  "apiVersion": "client.authentication.k8s.io/v1alpha1",
  "kind": "ExecCredential",
  "status": {
    "token": "my-bearer-token",
+    "clientCertificateData": "-----BEGIN CERTIFICATE-----\n...\n-----END CERTIFICATE-----",
+    "clientKeyData": "-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"


Another missing comma at the end of this line.

kubernetes/kubernetes#61803 implements TLS client credential support for 1.11.

mdlinville · 2018-06-04T17:48:12Z

I rebased to fix conflicts.

awly · 2018-06-05T16:38:10Z

Thanks @mistyhacks. Is there anything else that needs to be updated here?

mdlinville · 2018-06-06T21:28:10Z

@awly I just pushed a copyedit commit. PTAL and re-lgtm if it looks good to you. I re-worded for clarity, but I may have inadvertently changed some meaning.

awly · 2018-06-06T21:33:15Z

content/en/docs/reference/access-authn-authz/authentication.md

+Optionally, this output can include the expiry of the token formatted as a
+RFC3339 timestamp. If an expiry is omitted, the bearer token and TLS
+credentials are cached until the server responds with a 401 HTTP status code
+or until the process completes.


If expiry is present, cached credentials are still dropped when process exits.
This should probably be a separate sentence.

mdlinville · 2018-06-06T21:46:16Z

Thanks, updated again for clarity. PTAL.

/approve

awly · 2018-06-06T22:30:49Z

/lgtm

k8s-ci-robot · 2018-06-06T22:30:50Z

@awly: you cannot LGTM your own PR.

In response to this:

/lgtm

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

awly · 2018-06-06T22:31:30Z

@liggitt PTAL

mdlinville · 2018-06-06T22:58:15Z

I just pushed one more tiny copyedit. Please remove the hold when you're ready. I'm going to unapprove this until I know it's ready to go in, as if it is approved and the hold is removed, it goes in automatically.

/approve cancel

awly · 2018-06-06T23:03:59Z

LGTM
/hold cancel

mdlinville · 2018-06-06T23:19:21Z

/approve

Need a LGTM from a technical reviewer.

mikedanese · 2018-06-11T22:24:40Z

content/en/docs/reference/access-authn-authz/authentication.md

-If an expiry is omitted, the bearer token is cached until the server responds with a 401 HTTP
-status code. Note that this caching is only for the duration of process and therefore the plugin 
-is triggered each time the tool using the plugin is invoked.
+Optionally, the response can include the expiry of the token formatted as a


s/token/credential/ right?

k8s-ci-robot · 2018-06-11T22:31:55Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: mistyhacks

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [mistyhacks]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

mikedanese · 2018-06-11T22:41:21Z

/lgtm

* Update exec plugin docs with TLS credentials kubernetes/kubernetes#61803 implements TLS client credential support for 1.11. * Copyedit * More copyedits for clarification * Additional copyedit * Change token->credential

* Seperate priority and preemption (#8144) * Doc about PID pressure condition. (#8211) * Doc about PID pressure condition. Signed-off-by: Da K. Ma <[email protected]> * "so" -> "too" * Update version selector for 1.11 * StorageObjectInUseProtection is GA (#8291) * Feature gate: StorageObjectInUseProtection is GA Update feature gate reference for 1.11 * Trivial commit to re-trigger Netlify * CRIContainerLogRotation is Beta in 1.11 (#8665) * Seperate priority and preemption (#8144) * CRIContainerLogRotation is Beta in 1.11 xref: kubernetes/kubernetes#64046 * Bring StorageObjectInUseProtection feature to GA (#8159) * StorageObjectInUseProtection is GA (#8291) * Feature gate: StorageObjectInUseProtection is GA Update feature gate reference for 1.11 * Trivial commit to re-trigger Netlify * Bring StorageObjectInUseProtection feature to GA StorageObjectInUseProtection is Beta in K8s 1.10. It's brought to GA in K8s 1.11. * Fixed typo and added feature state tags. * Remove KUBE_API_VERSIONS doc (#8292) The support to the KUBER_API_VERSIONS environment variable is completely dropped (no deprecation). This PR removes the related doc in release-1.11. xref: kubernetes/kubernetes#63165 * Remove InitialResources from admission controllers (#8293) The feature (was experimental) is dropped in 1.11. xref: kubernetes/kubernetes#58784 * Remove docs related to in-tree support to GPU (#8294) * Remove docs related to in-tree support to GPU The in-tree support to GPU is completely removed in release 1.11. This PR removes the related docs in release-1.11 branch. xref: kubernetes/kubernetes#61498 * Update content updated by PR to Hugo syntax Signed-off-by: Misty Stanley-Jones <[email protected]> * Update the doc about extra volume in kubeadm config (#8453) Signed-off-by: Xianglin Gao <[email protected]> * Update CRD Subresources for 1.11 (#8519) * coredns: update notes in administer-cluster/coredns.md (#8697) CoreDNS is installed by default in 1.11. Add notes on how to install kube-dns instead. Update notes about CoreDNS->CoreDNS upgrades as in 1.11 the Corefile is retained. Add example on upgrading from kube-dns to CoreDNS. * kubeadm-alpha: CoreDNS related changes (#8727) Update note about CoreDNS feature gate. This change also updates a tab as a kubeadm sub-command will change. It looks for a new generated file: generated/kubeadm_alpha_phase_addon_coredns.md instead of: generated/kubeadm_alpha_phase_addon_kube-dns.md * Update cloud controller manager docs to beta 1.11 (#8756) * Update cloud controller manager docs to beta 1.11 * Use Hugo shortcode for feature state * kubeadm-upgrade: include new command `kubeadm upgrade diff` (#8617) Also: - Include note that this was added in 1.11. - Modify the note about upgrade guidance. * independent: update CoreDNS mentions for kubeadm (#8753) Give CoreDNS instead of kube-dns examples in: - docs/setup/independent/create-cluster-kubeadm.md - docs/setup/independent/troubleshooting-kubeadm.md * update 1.11 --server-print info (#8870) * update 1.11 --server-print info * Copyedit * Mark ExpandPersistentVolumes feature to beta (#8778) * Update version selector for 1.11 * Mark ExpandPersistentVolumes Beta xref: kubernetes/kubernetes#64288 * fix shortcode, add placeholder files to fix deploy failures (#8874) * declare ipvs ga (#8850) * kubeadm: update info about CoreDNS in kubeadm-init.md (#8728) Add info to install kube-dns instead of CoreDNS, as CoreDNS is the default DNS server in 1.11. Add notes that kubeadm config images can be used to list and pull the required images in 1.11. * kubeadm: update implementation-details.md about CoreDNS (#8829) - Replace examples from kube-dns to CoreDNS - Add notes about the CoreDNS feature gate status in 1.11 - Add note that the service name for CoreDNS is also called `kube-dns` * Update block device support for 1.11 (#8895) * Update block device support for 1.11 * Copyedits * Fix typo 'fiber channel' (#8957) Signed-off-by: Misty Stanley-Jones <[email protected]> * kubeadm-upgrade: add the 'node [config]' sub-command (#8960) - Add includes for the generated pages - Include placeholder generated pages * kubeadm-init: update the example for the MasterConfiguration (#8958) - include godocs link for MasterConfiguration - include example MasterConfiguration - add note that `kubeadm config print-default` can be used * kubeadm-config: include new commands (#8862) Add notes and includes for these new commands in 1.11: - kubeadm config print-default - kubeadm config migrate - kubeadm config images list - kubeadm config images pull Include placeholder generated files for the above. * administer-cluster/coredns: include more changes (#8985) It was requested that for this page a couple of methods should be outlined: - manual installation for CoreDNS explained at the Kubernetes section of the GitHub project for CoreDNS - installation and upgrade via kubeadm Make the above changes and also add a section "About CoreDNS". This commit also lowercases a section title. * Update CRD subresources doc for 1.11 (#8918) * Add docs for volume expansion and online resizing (#8896) * Add docs for volume expansion going beta * Copyedit * Address feedback * Update exec plugin docs with TLS credentials (#8826) * Update exec plugin docs with TLS credentials kubernetes/kubernetes#61803 implements TLS client credential support for 1.11. * Copyedit * More copyedits for clarification * Additional copyedit * Change token->credential * NodeRestriction admission prevents kubelet taint removal (#8911) * dns-custom-namerserver: break down the page into mutliple sections (#8900) * dns-custom-namerserver: break down the page into mutliple sections This page is currently about kube-dns and is a bit outdated. Introduce the heading `# Customizing kube-dns`. Introduce a separate section about CoreDNS. * Copyedits, fix headings for customizing DNS Hey Lubomir, I coypedited pretty heavily because this workflow is so much easier for docs and because I'm trying to help improve everything touching kubeadm as much as possible. But there's one outstanding issue wrt headings and intro content: you can't add a heading 1 to a topic to do what you wanted to do. The page title in the front matter is rendered as a heading 1 and everything else has to start at heading 2. (We still need to doc this better in the docs contributing content, I know.) Instead, I think we need to rewrite the top-of-page intro content to explain better the relationship between kube-dns and CoreDNS. I'm happy to write something, but I thought I'd push this commit first so you can see what I'm doing. Hope it's all clear -- ping here or on Slack with any questions ~ Jennifer * Interim fix for talking about CoreDNS * Fix CoreDNS details * PSP readOnly hostPath (#8898) * Add documentation for crictl (#8880) * Add documentation for crictl * Copyedit Signed-off-by: Misty Stanley-Jones <[email protected]> * Final copyedit * VolumeSubpathEnvExpansion alpha feature (#8835) * Note that Heapster is deprecated (#8827) * Note that Heapster is deprecated This notes that Heapster is deprecated, and migrates the relevant docs to talk about metrics-server or other solutions by default. * Copyedits and improvements Signed-off-by: Misty Stanley-Jones <[email protected]> * Address feedback * fix shortcode to troubleshoot deploy (#9057) * update dynamic kubelet config docs for v1.11 (#8766) * update dynamic kubelet config docs for v1.11 * Substantial copyedit * Address feedback * Reference doc for kubeadm (release-1.11) (#9044) * Reference doc for kubeadm (release-1.11) * fix shortcode to troubleshoot deploy (#9057) * Reference doc for kube-components (release-1.11) (#9045) * Reference doc for kube-components (release-1.11) * Update cloud-controller-manager.md * fix shortcode to troubleshoot deploy (#9057) * Documentation on lowercasing kubeadm init apiserver SANs (#9059) * Documentation on lowercasing kubeadm init apiserver SANs * fix shortcode to troubleshoot deploy (#9057) * Clarification in dynamic Kubelet config doc (#9061) * Promote sysctls to Beta (#8804) * Promote sysctls to Beta * Copyedits Signed-off-by: Misty Stanley-Jones <[email protected]> * Review comments * Address feedback * More feedback * kubectl reference docs for 1.11 (#9080) * Update Kubernetes API 1.11 ref docs (#8977) * Update v1alpha1 to v1beta1. * Adjust left nav for 1.11 ref docs. * Trim list of old ref docs. * Update Federation API ref docs for 1.11. (#9064) * Update Federation API ref docs for 1.11. * Add titles. * Update definitions.html * CRD versioning Public Documentation (#8834) * CRD versioning Public Documentation * Copyedit Signed-off-by: Misty Stanley-Jones <[email protected]> * Address feedback * More rewrites * Address feedback * Update main CRD page in light of versioning * Reorg CRD docs * Further reorg * Tweak title * CSI documentation update for raw block volume support (#8927) * CSI documetation update for raw block volume support * minor edits for "CSI raw block volume support" Some small grammar and style nits. * minor CSIBlockVolume edits * Update kubectl component ref page for 1.11. (#9094) * Update kubectl component ref page for 1.11. * Add title. Replace stevepe with username. * crd versioning doc: fix nits (#9142) * Update `DynamicKubeletConfig` feature to beta (#9110) xref: kubernetes/kubernetes#64275 * Documentation for dynamic volume limits based on node type (#8871) * add cos for storage limits * Update docs specific for aws and gce * fix some minor things * Update storage-limits.md * Add k8s version to feature-state shortcode * The Doc update for ScheduleDaemonSetPods (#8842) Signed-off-by: Da K. Ma <[email protected]> * Update docs related to PersistentVolumeLabel admission control (#9109) The said admission controller is disabled by default in 1.11 (kubernetes/kubernetes#64326) and scheduled to be removed in future release. * client exec auth: updates for 1.11 (#9154) * Updates HA kubeadm docs (#9066) * Updates HA kubeadm docs Signed-off-by: Chuck Ha <[email protected]> * kubeadm HA - Add stacked control plane steps * ssh instructions and some typos in the bash scripts Signed-off-by: Chuck Ha <[email protected]> * Fix typos and copypasta errors * Fix rebase issues * Integrate more changes Signed-off-by: Chuck Ha <[email protected]> * copyedits, layout and formatting fixes * final copyedits * Adds a sanity check for load balancer connection Signed-off-by: Chuck Ha <[email protected]> * formatting fixes, copyedits * fix typos, formatting * Document the Pod Ready++ feature (#9180) Closes: #9107 Xref: kubernetes/kubernetes#64057 * Mention 'KubeletPluginsWatcher' feature (#9177) * Mention 'KubeletPluginsWatcher' feature This feature is more developers oriented than users oriented, so simply mention it in the feature gate should be fine. In future, when the design doc is migrated from Google doc to the kubernetes/community repo, we can add links to it for users who want to dig deeper. Closes: #9108 Xref: kubernetes/kubernetes#63328, kubernetes/kubernetes#64605 * Copyedit * Amend dynamic volume list docs (#9181) The dynamic volume list feature has been documented but the feature gate related was not there yet. Closes: #9105 * Document for service account projection (#9182) This adds docs for the service account projection feature. Xref: kubernetes/kubernetes#63819, kubernetes/community#1973 Closes: #9102 * Update pod priority and preemption user docs (#9172) * Update pod priority and preemption user docs * Copyedit * Documentation on setting node name with Kubeadm (#8925) * Documentation on setting node name with Kubeadm * copyedit * Add kubeadm upgrade docs for 1.11 (#9089) * Add kubeadm upgrade docs for 1.11 * Initial docs review feedback * Add 1-11 to outline * Fix formatting on tab blocks * Move file to correct location * Add `kubeadm upgrade node config` step * Overzealous ediffing * copyedit, fix lists and headings * clarify --force flag for fixing bad state * Get TOML ready for 1.11 release * Blog post for 1.11 release (#9254) * Blog post for 1.11 release * Update 2018-06-26-kubernetes-1.11-release-announcement.md * Update 2018-06-26-kubernetes-1.11-release-announcement.md * Update 2018-06-26-kubernetes-1.11-release-announcement.md

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label May 30, 2018

k8s-ci-robot requested review from lavalamp and liggitt May 30, 2018 22:13

k8s-ci-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label May 30, 2018

k8s-ci-robot assigned mdlinville May 30, 2018

awly mentioned this pull request May 30, 2018

Add TLS support to exec authenticator plugin kubernetes/kubernetes#61803

Merged

liggitt reviewed May 30, 2018

View reviewed changes

mdlinville reviewed May 30, 2018

View reviewed changes

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label May 30, 2018

mdlinville added this to the 1.11 milestone May 30, 2018

mdlinville force-pushed the release-1.11 branch from 4b3430b to 7549d77 Compare June 4, 2018 17:24

Update exec plugin docs with TLS credentials

85ffdb9

kubernetes/kubernetes#61803 implements TLS client credential support for 1.11.

awly mentioned this pull request Jun 5, 2018

client exec auth: updates for 1.11 #8932

Closed

Copyedit

bd80083

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Jun 6, 2018

awly commented Jun 6, 2018

View reviewed changes

More copyedits for clarification

907f964

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 6, 2018

Additional copyedit

7f6c525

k8s-ci-robot removed the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 6, 2018

k8s-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 6, 2018

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 6, 2018

zacharysarah added Needs Tech Review labels Jun 11, 2018

mikedanese reviewed Jun 11, 2018

View reviewed changes

Change token->credential

15a01ac

k8s-ci-robot assigned mikedanese Jun 11, 2018

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Jun 11, 2018

k8s-ci-robot merged commit d9e6d0d into kubernetes:release-1.11 Jun 11, 2018

awly deleted the exec-plugin-tls-credentials branch July 26, 2018 17:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update exec plugin docs with TLS credentials #8826

Update exec plugin docs with TLS credentials #8826

awly commented May 30, 2018

k8sio-netlify-preview-bot commented May 30, 2018 •

edited

Loading

awly commented May 30, 2018

awly commented May 30, 2018

liggitt May 30, 2018

awly May 30, 2018

liggitt May 30, 2018

awly May 30, 2018

liggitt May 30, 2018

awly May 30, 2018

liggitt commented May 30, 2018

mdlinville left a comment

mdlinville May 30, 2018

awly May 30, 2018

mdlinville May 30, 2018

awly May 30, 2018

mdlinville May 30, 2018

awly May 30, 2018

mdlinville commented Jun 4, 2018

awly commented Jun 5, 2018

mdlinville commented Jun 6, 2018

awly Jun 6, 2018

mdlinville commented Jun 6, 2018

awly commented Jun 6, 2018

k8s-ci-robot commented Jun 6, 2018

awly commented Jun 6, 2018

mdlinville commented Jun 6, 2018

awly commented Jun 6, 2018

mdlinville commented Jun 6, 2018

mikedanese Jun 11, 2018

awly Jun 11, 2018

k8s-ci-robot commented Jun 11, 2018

mikedanese commented Jun 11, 2018

Update exec plugin docs with TLS credentials #8826

Update exec plugin docs with TLS credentials #8826

Conversation

awly commented May 30, 2018

k8sio-netlify-preview-bot commented May 30, 2018 • edited Loading

awly commented May 30, 2018

awly commented May 30, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

liggitt commented May 30, 2018

mdlinville left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mdlinville commented Jun 4, 2018

awly commented Jun 5, 2018

mdlinville commented Jun 6, 2018

Choose a reason for hiding this comment

mdlinville commented Jun 6, 2018

awly commented Jun 6, 2018

k8s-ci-robot commented Jun 6, 2018

awly commented Jun 6, 2018

mdlinville commented Jun 6, 2018

awly commented Jun 6, 2018

mdlinville commented Jun 6, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

k8s-ci-robot commented Jun 11, 2018

mikedanese commented Jun 11, 2018

k8sio-netlify-preview-bot commented May 30, 2018 •

edited

Loading