From 087a2884b3786ec98a9a883009cf5a443a969513 Mon Sep 17 00:00:00 2001 From: Avi Deitcher Date: Tue, 29 Jan 2019 03:40:43 +0200 Subject: [PATCH] Add information about linking CN= and kubelet hostname (#12336) --- content/en/docs/reference/access-authn-authz/node.md | 3 +++ content/en/docs/setup/certificates.md | 6 +++++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/content/en/docs/reference/access-authn-authz/node.md b/content/en/docs/reference/access-authn-authz/node.md index 5c6d0242e5..f716a99b54 100644 --- a/content/en/docs/reference/access-authn-authz/node.md +++ b/content/en/docs/reference/access-authn-authz/node.md @@ -45,6 +45,9 @@ being in the `system:nodes` group, with a username of `system:node:`. This group and user name format match the identity created for each kubelet as part of [kubelet TLS bootstrapping](/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/). +The value of `` **must** match precisely the name of the node as registered by the kubelet. By default, this is the host name as provided by `hostname`, or overridden via the [kubelet option](/docs/reference/command-line-tools-reference/kubelet/) `--hostname-override`. However, when using the `--cloud-provider` kubelet option, the specific hostname may be determined by the cloud provider, ignoring the local `hostname` and the `--hostname-override` option. +For specifics about how the kubelet determines the hostname, as well as cloud provider overrides, see the [kubelet options reference](/docs/reference/command-line-tools-reference/kubelet/) and the [cloud provider details](/docs/concepts/cluster-administration/cloud-providers/). + To enable the Node authorizer, start the apiserver with `--authorization-mode=Node`. To limit the API objects kubelets are able to write, enable the [NodeRestriction](/docs/reference/access-authn-authz/admission-controllers#NodeRestriction) admission plugin by starting the apiserver with `--enable-admission-plugins=...,NodeRestriction,...` diff --git a/content/en/docs/setup/certificates.md b/content/en/docs/setup/certificates.md index 1e87f7586a..460bcf7db8 100644 --- a/content/en/docs/setup/certificates.md +++ b/content/en/docs/setup/certificates.md @@ -109,10 +109,14 @@ You must manually configure these administrator account and service accounts: | filename | credential name | Default CN | O (in Subject) | |-------------------------|----------------------------|--------------------------------|----------------| | admin.conf | default-admin | kubernetes-admin | system:masters | -| kubelet.conf | default-auth | system:node:`` | system:nodes | +| kubelet.conf | default-auth | system:node:`` (see note) | system:nodes | | controller-manager.conf | default-controller-manager | system:kube-controller-manager | | | scheduler.conf | default-manager | system:kube-scheduler | | +{{< note >}} +The value of `` for `kubelet.conf` **must** match precisely the value of the node name provided by the kubelet as it registers with the apiserver. For further details, read the [Node Authorization](/docs/reference/access-authn-authz/node/). +{{< /note >}} + 1. For each config, generate an x509 cert/key pair with the given CN and O. 1. Run `kubectl` as follows for each config: