From 831833d6b36f1f26bb59871ad77d618df731bcdc Mon Sep 17 00:00:00 2001 From: Weibin Lin Date: Sat, 16 Sep 2017 08:30:05 +0800 Subject: [PATCH 1/2] Update docs/admin/authentication.md (#5408) * Update docs/admin/authentication.md * Update authentication.md --- docs/admin/authentication.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/docs/admin/authentication.md b/docs/admin/authentication.md index b0f4467527..c449d511ad 100644 --- a/docs/admin/authentication.md +++ b/docs/admin/authentication.md @@ -168,7 +168,7 @@ with a value of `Basic BASE64ENCODED(USER:PASSWORD)`. ### Service Account Tokens -Service accounts are an automatically enabled authenticator that uses signed +A service account is an automatically enabled authenticator that uses signed bearer tokens to verify requests. The plugin takes two optional flags: * `--service-account-key-file` A file containing a PEM encoded key for signing bearer tokens. @@ -281,8 +281,8 @@ Since all of the data needed to validate who you are is in the `id_token`, Kuber solution for authentication. It does offer a few challenges: 1. Kubernetes has no "web interface" to trigger the authentication process. There is no browser or interface to collect credentials which is why you need to authenticate to your identity provider first. -2. The `id_token` can't be revoked, it's like a certificate so it should be short-lived (only a few minutes) so it can be very annoying to have to get a new token every few minutes -3. There's no easy way to authenticate to the Kubernetes dashboard without using the `kubectl proxy` command or a reverse proxy that injects the `id_token` +2. The `id_token` can't be revoked, it's like a certificate so it should be short-lived (only a few minutes) so it can be very annoying to have to get a new token every few minutes. +3. There's no easy way to authenticate to the Kubernetes dashboard without using the `kubectl proxy` command or a reverse proxy that injects the `id_token`. #### Configuring the API Server @@ -728,7 +728,7 @@ Finally, add the following parameters into API server start parameters: ./easyrsa --batch "--req-cn=${MASTER_IP}@`date +%s`" build-ca nopass 1. Generate server certificate and key. - (build-server-full [filename]: Generate a keypair and sign locally for a client or server) + (build-server-full [filename]: Generate a keypair and sign locally for a client or server.) ./easyrsa --subject-alt-name="IP:${MASTER_IP}" build-server-full server nopass 1. Copy `pki/ca.crt`, `pki/issued/server.crt`, and `pki/private/server.key` to your directory. @@ -748,7 +748,7 @@ Finally, add the following parameters into API server start parameters: 1. According to the ca.key generate a ca.crt (use -days to set the certificate effective time): openssl req -x509 -new -nodes -key ca.key -subj "/CN=${MASTER_IP}" -days 10000 -out ca.crt -1. Generate a server.key with 2048bit +1. Generate a server.key with 2048bit: openssl genrsa -out server.key 2048 1. According to the server.key generate a server.csr: From 667b7d474a07b5a9b72c1afd49427e39e657ed04 Mon Sep 17 00:00:00 2001 From: Kaitlyn Barnard Date: Fri, 15 Sep 2017 17:30:54 -0700 Subject: [PATCH 2/2] Adding Treasure Data to KCSP page (#5488) * Adding Treasure Data to KCSP page * Updating service partner text --- _includes/partner-script.js | 4 ++-- partners/index.html | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/_includes/partner-script.js b/_includes/partner-script.js index c77537e522..1eee70ad9f 100644 --- a/_includes/partner-script.js +++ b/_includes/partner-script.js @@ -261,7 +261,7 @@ }, { type: 2, - name: 'inwinSTACK', + name: 'InwinSTACK', logo: 'inwinstack', link: 'http://www.inwinstack.com/index.php/en/solutions-en/', blurb: 'Our container service leverages OpenStack-based infrastructure and its container orchestration engine Magnum to manage Kubernetes clusters.' @@ -498,7 +498,7 @@ blurb: 'Generate a real-time, auto-discovered application topology map! Monitor Kubernetes pods and namespaces without any code instrumentation.' }, { - type: 0, + type: 2, name: 'Treasure Data', logo: 'treasure-data', link: 'https://fluentd.treasuredata.com/kubernetes-logging/', diff --git a/partners/index.html b/partners/index.html index f19649cf77..7da3441835 100644 --- a/partners/index.html +++ b/partners/index.html @@ -17,7 +17,7 @@ cid: partners
Kubernetes Certified Service Providers
Vetted service providers with deep experience helping enterprises successfully adopt Kubernetes.

Technology Partners
Integrations and plugins that add features to Kubernetes applications.


-
Service Providers
Consulting or management services to help companies implement Kubernetes in commercial applications.

+
Service Partners
Consulting or management services to help companies implement Kubernetes in commercial applications.

Kubernetes Certified Service Providers (KCSP)

The KCSP program is a vetted tier of service providers who have deep experience helping enterprises successfully adopt Kubernetes. KCSP partners offer Kubernetes support, consulting, professional services and training for organizations embarking on their Kubernetes journey.

@@ -27,8 +27,8 @@ cid: partners

Technology partners offer integrations and plugins that add features to Kubernetes applications.

Interested in becoming a Technology Partner? Please fill out this form.

-

Services Partners

-

Service Providers offer consulting or management services to help companies implement and use Kubernetes in commercial applications.

+

Service Partners

+

Service Partners offer consulting or management services to help companies implement and use Kubernetes in commercial applications.

Interested in becoming a Service Provider? Please fill out this form