kubeadm: add guide for kubelet serving certs and metrics-server #27071

neolit123 · 2021-03-15T20:22:02Z

note: targeting the master branch is accurate for this change.

Include a new section of the kubeadm certificate management page
to talk about kubelet serving certificates and how to make
them signed. Also include a note about using secure connection
with the metrics-server.

fixes kubernetes/kubeadm#1602

/sig cluster-lifecycle

neolit123 · 2021-03-15T20:22:18Z

/cc @fabriziopandini @randomvariable

netlify · 2021-03-15T20:34:38Z

Deploy preview for kubernetes-io-master-staging ready!

Built with commit 30c6e77

https://deploy-preview-27071--kubernetes-io-master-staging.netlify.app

content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md

sftim

Thanks!

Some feedback. I'm not sure about the heading “Cannot use the metrics-server securely in a kubeadm cluster” and also I'd like to include a 3rd party content warning for kubelet-rubber-stamp.

Plus a few less important details.

content/en/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm.md

content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md

neolit123 · 2021-03-23T23:03:44Z

updated to address the review comments.

fabriziopandini · 2021-03-24T09:11:44Z

content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md

+Third party custom controllers can be used:
+- [kubelet-rubber-stamp](https://github.com/kontena/kubelet-rubber-stamp)
+
+Such a controller is not a secure mechanism unless it not only verifies the CommonName
+in the CSR but also verifies the requested IPs and domain names. This would prevent
+a malicious actor that has access to a kubelet client certificate to create
+CSRs requesting serving certificates for any IP or domain name.


I don't think we should express options on external project; TBH I would avoid the link entirely but I don't want to block on this

@sftim and randomvariable seem to be fine with mentioning this third-party option.

for cloud provider scenarios we already tell users to consult their provider.
users that don't trust this would have to either use a different rubber-stamp or write their own controller / DS / scripts.

alvaroaleman · 2021-04-03T15:17:41Z

@neolit123: PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

sftim · 2021-04-03T15:36:24Z

Needs a rebase, but assuming the obvious approach to rebasing: LGTM.

neolit123 · 2021-04-03T18:02:11Z

rebased.

/cc @fabriziopandini
for tech review / LGTM.

sftim

Some feedback. I don't think it need block merging these changes.

LGTM!

content/en/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm.md

sftim · 2021-04-03T23:29:39Z

content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md

+- Find and edit the `kubelet-config-x.yy` ConfigMap under `kube-system` to include
+the field `serverTLSBootstrap: true` under the `config` key


We could also write:

Suggested change

- Find and edit the `kubelet-config-x.yy` ConfigMap under `kube-system` to include

the field `serverTLSBootstrap: true` under the `config` key

- Find and edit the `kubelet-config-{{< skew latestVersion >}}` ConfigMap in the `kube-system` namespace.

In that ConfigMap, the `config` key has a

[kubelet configuration](/docs/reference/config-api/kubelet-config.v1beta1/#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) document as

its value. Edit the kubelet configuration document to set `serverTLSBootstrap: true`.

(untested!)

maybe in a follow-up PR?

https://kubernetes.io/docs/tasks/administer-cluster/reconfigure-kubelet/ recommends changing the ConfigMap that kubelets use (a different name); is that advice related to what's recommended here?

maybe in a follow-up PR?

updated in this PR.

https://kubernetes.io/docs/tasks/administer-cluster/reconfigure-kubelet/ recommends changing the ConfigMap that kubelets use (a different name); is that advice related to what's recommended here?

kubeadm uses a single ConfigMap, so need to introduce a new ConfigMap with a different name.

fabriziopandini

/lgtm

k8s-ci-robot · 2021-04-06T10:16:18Z

LGTM label has been added.

Git tree hash: 7026c4a74d5a963e5d7e1975c03ed0b156e6f363

Include a new section of the kubeadm certificate management page to talk about kubelet serving certificates and how to make them signed. Also include a note about using secure connection with the metrics-server.

neolit123 · 2021-04-06T22:21:14Z

@sftim
updated with your two suggestions above.
tech LGTM already passed by @fabriziopandini

kbhawkey · 2021-04-20T01:35:45Z

Page previews:
https://deploy-preview-27071--kubernetes-io-master-staging.netlify.app/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#kubelet-serving-certs
https://deploy-preview-27071--kubernetes-io-master-staging.netlify.app/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm/#cannot-use-the-metrics-server-securely-in-a-kubeadm-cluster

kbhawkey · 2021-04-20T01:36:56Z

/approve

k8s-ci-robot · 2021-04-20T01:37:07Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kbhawkey

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~content/en/OWNERS~~ [kbhawkey]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

kbhawkey · 2021-04-21T01:30:17Z

/lgtm

k8s-ci-robot · 2021-04-21T01:30:27Z

LGTM label has been added.

Git tree hash: 59c4229345bb7edcf59b4501db23c61b8575a2f1

k8s-ci-robot added sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Mar 15, 2021

k8s-ci-robot requested review from fabriziopandini, randomvariable, kbarnard10 and rajeshdeshpande02 March 15, 2021 20:22

k8s-ci-robot added language/en Issues or PRs related to English language sig/docs Categorizes an issue or PR as relevant to SIG Docs. labels Mar 15, 2021

This was referenced Mar 15, 2021

provide workarounds for the kubelet self-signed serving certificate kubernetes/kubeadm#1602

Closed

use signed kubelet serving certificates kubernetes/kubeadm#1223

Open

jdef reviewed Mar 15, 2021

View reviewed changes

content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md Outdated Show resolved Hide resolved

sftim reviewed Mar 16, 2021

View reviewed changes

neolit123 force-pushed the 1.21-add-kubelet-serving-cert-guide branch 2 times, most recently from f6a9a3a to 3de80b5 Compare March 23, 2021 23:03

fabriziopandini reviewed Mar 24, 2021

View reviewed changes

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Apr 3, 2021

neolit123 force-pushed the 1.21-add-kubelet-serving-cert-guide branch from 3de80b5 to 1434983 Compare April 3, 2021 18:01

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Apr 3, 2021

k8s-ci-robot requested a review from fabriziopandini April 3, 2021 18:02

sftim reviewed Apr 3, 2021

View reviewed changes

fabriziopandini reviewed Apr 6, 2021

View reviewed changes

k8s-ci-robot assigned fabriziopandini Apr 6, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 6, 2021

kubeadm: add guide for kubelet serving certs and metrics-server

30c6e77

Include a new section of the kubeadm certificate management page to talk about kubelet serving certificates and how to make them signed. Also include a note about using secure connection with the metrics-server.

neolit123 force-pushed the 1.21-add-kubelet-serving-cert-guide branch from 1434983 to 30c6e77 Compare April 6, 2021 22:19

k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 6, 2021

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 20, 2021

k8s-ci-robot assigned kbhawkey Apr 21, 2021

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 21, 2021

k8s-ci-robot merged commit 9b300a4 into kubernetes:master Apr 21, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

kubeadm: add guide for kubelet serving certs and metrics-server #27071

kubeadm: add guide for kubelet serving certs and metrics-server #27071

neolit123 commented Mar 15, 2021 •

edited

Loading

neolit123 commented Mar 15, 2021

netlify bot commented Mar 15, 2021 •

edited

Loading

sftim left a comment

neolit123 commented Mar 23, 2021

fabriziopandini Mar 24, 2021

neolit123 Mar 24, 2021 •

edited

Loading

alvaroaleman commented Apr 3, 2021

sftim commented Apr 3, 2021

neolit123 commented Apr 3, 2021

sftim left a comment

sftim Apr 3, 2021 •

edited

Loading

sftim Apr 3, 2021

neolit123 Apr 6, 2021

fabriziopandini left a comment

k8s-ci-robot commented Apr 6, 2021

neolit123 commented Apr 6, 2021

kbhawkey commented Apr 20, 2021

kbhawkey commented Apr 20, 2021

k8s-ci-robot commented Apr 20, 2021

kbhawkey commented Apr 21, 2021

k8s-ci-robot commented Apr 21, 2021

		- Find and edit the `kubelet-config-x.yy` ConfigMap under `kube-system` to include
		the field `serverTLSBootstrap: true` under the `config` key

-- Find and edit the `kubelet-config-x.yy` ConfigMap under `kube-system` to include
-the field `serverTLSBootstrap: true` under the `config` key
+ - Find and edit the `kubelet-config-{{< skew latestVersion >}}` ConfigMap in the `kube-system` namespace.
+   In that ConfigMap, the `config` key has a
+   [kubelet configuration](/docs/reference/config-api/kubelet-config.v1beta1/#kubelet-config-k8s-io-v1beta1-KubeletConfiguration) document as
+   its value. Edit the kubelet configuration document to set `serverTLSBootstrap: true`.

kubeadm: add guide for kubelet serving certs and metrics-server #27071

kubeadm: add guide for kubelet serving certs and metrics-server #27071

Conversation

neolit123 commented Mar 15, 2021 • edited Loading

neolit123 commented Mar 15, 2021

netlify bot commented Mar 15, 2021 • edited Loading

sftim left a comment

Choose a reason for hiding this comment

neolit123 commented Mar 23, 2021

fabriziopandini Mar 24, 2021

Choose a reason for hiding this comment

neolit123 Mar 24, 2021 • edited Loading

Choose a reason for hiding this comment

alvaroaleman commented Apr 3, 2021

sftim commented Apr 3, 2021

neolit123 commented Apr 3, 2021

sftim left a comment

Choose a reason for hiding this comment

sftim Apr 3, 2021 • edited Loading

Choose a reason for hiding this comment

sftim Apr 3, 2021

Choose a reason for hiding this comment

neolit123 Apr 6, 2021

Choose a reason for hiding this comment

fabriziopandini left a comment

Choose a reason for hiding this comment

k8s-ci-robot commented Apr 6, 2021

neolit123 commented Apr 6, 2021

kbhawkey commented Apr 20, 2021

kbhawkey commented Apr 20, 2021

k8s-ci-robot commented Apr 20, 2021

kbhawkey commented Apr 21, 2021

k8s-ci-robot commented Apr 21, 2021

neolit123 commented Mar 15, 2021 •

edited

Loading

netlify bot commented Mar 15, 2021 •

edited

Loading

neolit123 Mar 24, 2021 •

edited

Loading

sftim Apr 3, 2021 •

edited

Loading