From 20b63076db8477c6ebbd1ccea01e3b29523ff2d9 Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Thu, 7 Dec 2017 13:30:04 -0600 Subject: [PATCH 1/2] Add kubelet authn/authz to recommendations --- docs/tasks/administer-cluster/securing-a-cluster.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/docs/tasks/administer-cluster/securing-a-cluster.md b/docs/tasks/administer-cluster/securing-a-cluster.md index 70645afcb5..39d3f8fdb9 100644 --- a/docs/tasks/administer-cluster/securing-a-cluster.md +++ b/docs/tasks/administer-cluster/securing-a-cluster.md @@ -1,6 +1,9 @@ --- approvers: - smarterclayton +- liggitt +- ericchiang +- destijl title: Securing a Cluster --- @@ -68,6 +71,15 @@ to prevent accidental escalation. You can make roles specific to your use case i Consult the [authorization reference section](/docs/admin/authorization/) for more information. +## Controlling access to the Kubelet + +Kubelets expose HTTPS endpoints which give access to data of varying sensitivity, and allow performing operations with varying levels of power on the node and within containers. + +By default, Kubelets allow full access to those endpoints. + +To secure access to those endpoints, enable Kubelet authentication and authorization. + +Consult the [Kubelet authentication/authorization reference](/docs/admin/kubelet-authentication-authorization) for more information. ## Controlling the capabilities of a workload or user at runtime From f390b50374bdf43383d2646c2aa896abc2e68379 Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Thu, 7 Dec 2017 13:30:56 -0600 Subject: [PATCH 2/2] Audit to beta --- docs/tasks/administer-cluster/securing-a-cluster.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/tasks/administer-cluster/securing-a-cluster.md b/docs/tasks/administer-cluster/securing-a-cluster.md index 39d3f8fdb9..2b3d192a49 100644 --- a/docs/tasks/administer-cluster/securing-a-cluster.md +++ b/docs/tasks/administer-cluster/securing-a-cluster.md @@ -163,7 +163,7 @@ access to a subset of the keyspace is strongly recommended. ### Enable audit logging -The [audit logger](/docs/tasks/debug-application-cluster/audit/) is an alpha feature that records actions taken by the +The [audit logger](/docs/tasks/debug-application-cluster/audit/) is a beta feature that records actions taken by the API for later analysis in the event of a compromise. It is recommended to enable audit logging and archive the audit file on a secure server.