From febeb5825b711527331fa901fe24efa4473bc5a0 Mon Sep 17 00:00:00 2001 From: George G Date: Fri, 15 Jul 2016 13:34:58 +0100 Subject: [PATCH 1/9] scratch.md: kubernetes/cluster/images/etcd/Makefile no longer uses ETCD_VERSION --- docs/getting-started-guides/scratch.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started-guides/scratch.md b/docs/getting-started-guides/scratch.md index a40b4ec546..658a1de190 100644 --- a/docs/getting-started-guides/scratch.md +++ b/docs/getting-started-guides/scratch.md @@ -179,7 +179,7 @@ For etcd, you can: We recommend that you use the etcd version which is provided in the Kubernetes binary distribution. The Kubernetes binaries in the release were tested extensively with this version of etcd and not with any other version. -The recommended version number can also be found as the value of `ETCD_VERSION` in `kubernetes/cluster/images/etcd/Makefile`. +The recommended version number can also be found as the value of `TAG` in `kubernetes/cluster/images/etcd/Makefile`. The remainder of the document assumes that the image identifiers have been chosen and stored in corresponding env vars. Examples (replace with latest tags and appropriate registry): From c2f5bf2cc650f933fadf715562d419f214e163ea Mon Sep 17 00:00:00 2001 From: George G Date: Fri, 15 Jul 2016 13:38:14 +0100 Subject: [PATCH 2/9] scratch.md: Don't duplicate CA instructions --- docs/getting-started-guides/scratch.md | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/docs/getting-started-guides/scratch.md b/docs/getting-started-guides/scratch.md index 658a1de190..34d75a79d8 100644 --- a/docs/getting-started-guides/scratch.md +++ b/docs/getting-started-guides/scratch.md @@ -208,11 +208,10 @@ You need to prepare several certs: - The kubelets optionally need certs to identify themselves as clients of the master, and when serving its own API over HTTPS. -Unless you plan to have a real CA generate your certs, you will need to generate a root cert and use that to sign the master, kubelet, and kubectl certs. - -- see function `create-certs` in `cluster/common.sh` -- see also `cluster/saltbase/salt/generate-cert/make-ca-cert.sh` and - `cluster/saltbase/salt/generate-cert/make-cert.sh` +Unless you plan to have a real CA generate your certs, you will need +to generate a root cert and use that to sign the master, kubelet, and +kubectl certs. How to do this is described in the [authentication +documentation](/docs/admin/authentication/#creating-certificates). You will end up with the following files (we will use these variables later on) From b678c151f5f573096f53f10994ae9c69b9db34c0 Mon Sep 17 00:00:00 2001 From: George G Date: Fri, 15 Jul 2016 14:35:58 +0100 Subject: [PATCH 3/9] scratch.md: Remove extra = --- docs/getting-started-guides/scratch.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started-guides/scratch.md b/docs/getting-started-guides/scratch.md index 34d75a79d8..a571e21845 100644 --- a/docs/getting-started-guides/scratch.md +++ b/docs/getting-started-guides/scratch.md @@ -183,7 +183,7 @@ The recommended version number can also be found as the value of `TAG` in `kuber The remainder of the document assumes that the image identifiers have been chosen and stored in corresponding env vars. Examples (replace with latest tags and appropriate registry): - - `HYPERKUBE_IMAGE==gcr.io/google_containers/hyperkube:$TAG` + - `HYPERKUBE_IMAGE=gcr.io/google_containers/hyperkube:$TAG` - `ETCD_IMAGE=gcr.io/google_containers/etcd:$ETCD_VERSION` ### Security Models From 489892d65d24face65093fc8e5a459b4c2c28ac0 Mon Sep 17 00:00:00 2001 From: George G Date: Fri, 15 Jul 2016 14:37:44 +0100 Subject: [PATCH 4/9] scratch.md: Clarify CA_CERT_BASE64_ENCODED / certificate-authority --- docs/getting-started-guides/scratch.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/getting-started-guides/scratch.md b/docs/getting-started-guides/scratch.md index a571e21845..d9e1a561d1 100644 --- a/docs/getting-started-guides/scratch.md +++ b/docs/getting-started-guides/scratch.md @@ -288,6 +288,10 @@ contexts: current-context: service-account-context ``` +Where CA_CERT_BASE64_ENCODED can be generated like `< ca.crt base64 +-w0`. Alternatively you can refer to a file (e.g. `certificate-authority: +/etc/kubernetes/ca.crt`). + Put the kubeconfig(s) on every node. The examples later in this guide assume that there are kubeconfigs in `/var/lib/kube-proxy/kubeconfig` and `/var/lib/kubelet/kubeconfig`. From 3e55a5ba5af6ef1c7d2f7614ed13fb5254a8302e Mon Sep 17 00:00:00 2001 From: George G Date: Fri, 15 Jul 2016 15:36:54 +0100 Subject: [PATCH 5/9] scratch.md: Fix formatting --- docs/getting-started-guides/scratch.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/getting-started-guides/scratch.md b/docs/getting-started-guides/scratch.md index d9e1a561d1..84f789a679 100644 --- a/docs/getting-started-guides/scratch.md +++ b/docs/getting-started-guides/scratch.md @@ -106,6 +106,7 @@ be active at once. Note that you can grow the end of this range, but you cannot move it without disrupting the services and pods that already use it. Also, you need to pick a static IP for master node. + - Call this `MASTER_IP`. - Open any firewalls to allow access to the apiserver ports 80 and/or 443. - Enable ipv4 forwarding sysctl, `net.ipv4.ip_forward = 1` From 5b91603d693cb9fa3a160d758c1e8048d3c310a5 Mon Sep 17 00:00:00 2001 From: George G Date: Fri, 15 Jul 2016 15:47:01 +0100 Subject: [PATCH 6/9] scratch.md: kubeconfig should not embed the CA cert --- docs/getting-started-guides/scratch.md | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/docs/getting-started-guides/scratch.md b/docs/getting-started-guides/scratch.md index 84f789a679..f1b222ae7e 100644 --- a/docs/getting-started-guides/scratch.md +++ b/docs/getting-started-guides/scratch.md @@ -280,7 +280,7 @@ users: clusters: - name: local cluster: - certificate-authority-data: ${CA_CERT_BASE64_ENCODED} + certificate-authority: /srv/kubernetes/ca.crt contexts: - context: cluster: local @@ -289,10 +289,6 @@ contexts: current-context: service-account-context ``` -Where CA_CERT_BASE64_ENCODED can be generated like `< ca.crt base64 --w0`. Alternatively you can refer to a file (e.g. `certificate-authority: -/etc/kubernetes/ca.crt`). - Put the kubeconfig(s) on every node. The examples later in this guide assume that there are kubeconfigs in `/var/lib/kube-proxy/kubeconfig` and `/var/lib/kubelet/kubeconfig`. From 0859bcfad15516df5d4ca6e79bd17badd7e9e20c Mon Sep 17 00:00:00 2001 From: George G Date: Fri, 15 Jul 2016 18:07:02 +0100 Subject: [PATCH 7/9] scratch.md: Add missing newline --- docs/getting-started-guides/scratch.md | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/getting-started-guides/scratch.md b/docs/getting-started-guides/scratch.md index f1b222ae7e..bf31a5422d 100644 --- a/docs/getting-started-guides/scratch.md +++ b/docs/getting-started-guides/scratch.md @@ -600,6 +600,7 @@ If you are following the firewall-only security approach, then use these argumen - `--advertise-address=$MASTER_IP` If you are using the HTTPS approach, then set: + - `--client-ca-file=/srv/kubernetes/ca.crt` - `--token-auth-file=/srv/kubernetes/known_tokens.csv` - `--basic-auth-file=/srv/kubernetes/basic_auth.csv` From 3195bc7db94a6faeef62a7f2d318c38b112742fc Mon Sep 17 00:00:00 2001 From: George G Date: Wed, 20 Jul 2016 12:01:25 +0100 Subject: [PATCH 8/9] scratch.md: Whitespace --- docs/getting-started-guides/scratch.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/getting-started-guides/scratch.md b/docs/getting-started-guides/scratch.md index bf31a5422d..d9817d4098 100644 --- a/docs/getting-started-guides/scratch.md +++ b/docs/getting-started-guides/scratch.md @@ -662,7 +662,7 @@ Complete this template for the scheduler pod: ], "livenessProbe": { "httpGet": { - "host" : "127.0.0.1", + "host": "127.0.0.1", "path": "/healthz", "port": 10251 }, From c6ad7e587f849273518be260a8aab957225e8055 Mon Sep 17 00:00:00 2001 From: George G Date: Thu, 21 Jul 2016 18:42:46 +0100 Subject: [PATCH 9/9] scratch.md: More consistent/explicit livenessProbes --- docs/getting-started-guides/scratch.md | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/docs/getting-started-guides/scratch.md b/docs/getting-started-guides/scratch.md index d9817d4098..8ebc6c81d9 100644 --- a/docs/getting-started-guides/scratch.md +++ b/docs/getting-started-guides/scratch.md @@ -553,8 +553,10 @@ For each of these components, the steps to start them running are similar: ], "livenessProbe": { "httpGet": { - "path": "/healthz", - "port": 8080 + "scheme": "HTTP", + "host": "127.0.0.1", + "port": 8080, + "path": "/healthz" }, "initialDelaySeconds": 15, "timeoutSeconds": 15 @@ -662,9 +664,10 @@ Complete this template for the scheduler pod: ], "livenessProbe": { "httpGet": { + "scheme": "HTTP", "host": "127.0.0.1", - "path": "/healthz", - "port": 10251 + "port": 10251, + "path": "/healthz" }, "initialDelaySeconds": 15, "timeoutSeconds": 15 @@ -717,9 +720,10 @@ Template for controller manager pod: ], "livenessProbe": { "httpGet": { + "scheme": "HTTP", "host": "127.0.0.1", - "path": "/healthz", - "port": 10252 + "port": 10252, + "path": "/healthz" }, "initialDelaySeconds": 15, "timeoutSeconds": 15