From 20b63076db8477c6ebbd1ccea01e3b29523ff2d9 Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Thu, 7 Dec 2017 13:30:04 -0600 Subject: [PATCH] Add kubelet authn/authz to recommendations --- docs/tasks/administer-cluster/securing-a-cluster.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/docs/tasks/administer-cluster/securing-a-cluster.md b/docs/tasks/administer-cluster/securing-a-cluster.md index 70645afcb5..39d3f8fdb9 100644 --- a/docs/tasks/administer-cluster/securing-a-cluster.md +++ b/docs/tasks/administer-cluster/securing-a-cluster.md @@ -1,6 +1,9 @@ --- approvers: - smarterclayton +- liggitt +- ericchiang +- destijl title: Securing a Cluster --- @@ -68,6 +71,15 @@ to prevent accidental escalation. You can make roles specific to your use case i Consult the [authorization reference section](/docs/admin/authorization/) for more information. +## Controlling access to the Kubelet + +Kubelets expose HTTPS endpoints which give access to data of varying sensitivity, and allow performing operations with varying levels of power on the node and within containers. + +By default, Kubelets allow full access to those endpoints. + +To secure access to those endpoints, enable Kubelet authentication and authorization. + +Consult the [Kubelet authentication/authorization reference](/docs/admin/kubelet-authentication-authorization) for more information. ## Controlling the capabilities of a workload or user at runtime