rebase certificates PR on Hugo master #9842
Conversation
Co-authored-by: liztio <[email protected]>
k8s-ci-robot
added
cncf-cla: yes
|
n.b. to reviewers and approvers: the content of this PR is already tech reviewed (see related PR). I offered to take over the Hugo rebase from the original author, who is credited as co-author on this PR. Please lgtm and approve, thanks! |
|
Deploy preview for kubernetes-io-master-staging ready! Built with commit 91a7702 https://deploy-preview-9842--kubernetes-io-master-staging.netlify.com |
|
|
||
| ## Where certificates are stored | ||
|
|
||
| Kubernetes stores certificates by default in `/etc/kubernetes/pki`. All paths in this documentation are relative to that directory. |
There was a problem hiding this comment.
It might be good to clarify that this is the default for kubeadm-installed clusters specifically.
| | Default CN | Parent CA | O (in Subject) | kind | hosts (SAN) | | ||
| |-------------------------------|---------------------------|----------------|----------------------------------------|---------------------------------------------| | ||
| | kube-etcd | etcd-ca | | server, client [<sup>1</sup>][etcdbug] | `localhost`, `127.0.0.1` | | ||
| | kube-etcd-peer | etcd-ca | | peer | `<hostname>`, `<Host_IP>`, `localhost`, `127.0.0.1` | |
There was a problem hiding this comment.
It would probably be better to standardize both of these to either use server, client or peer, rather than using both.
|
|
||
| ## Configure certificates for user accounts | ||
|
|
||
| You must manually configure thesee administrator account and service accounts: |
| | kind | TLS role | | ||
| |--------|---------------------------------------------------------------------------------------------------| | ||
| | server | Digital Signature, Key Encipherment, TLS Web Server Authentication | | ||
| | peer | Digital Signature, Key Encipherment, TLS Web Server Authentication, TLS Web Client Authentication | |
There was a problem hiding this comment.
peer here is no longer referenced.
|
Great job!!! |
k8s-ci-robot
added
the
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: bradtopol The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
Co-authored-by: liztio [email protected]
Finally rebasing #8232 on Hugo, with many thanks to @liztio for all her patience.
Added a couple of stray fixes to kubelet integration topic while I was at it.
Still needed, to add in a separate PR: