From e319cf578860598df157d4aa272dc13785f21f5b Mon Sep 17 00:00:00 2001 From: shashidharatd Date: Tue, 3 Oct 2017 01:46:55 +0530 Subject: [PATCH] Fix an incorrect flag in configure-upgrade-etcd.md (#5304) 1. There is no flag called `--trust-ca-file` in etcd and i presume it is `--trusted-ca-file` 2. Using the same key and cert peer.key and peer.cert for both peer communication and client communication, confuses user. So differentiated it. --- docs/tasks/administer-cluster/configure-upgrade-etcd.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/tasks/administer-cluster/configure-upgrade-etcd.md b/docs/tasks/administer-cluster/configure-upgrade-etcd.md index c5b7037185..97253f00a0 100644 --- a/docs/tasks/administer-cluster/configure-upgrade-etcd.md +++ b/docs/tasks/administer-cluster/configure-upgrade-etcd.md @@ -84,13 +84,13 @@ To secure etcd, either set up firewall rules or use the security features provid To configure etcd with secure peer communication, specify flags `--peer-key-file=peer.key` and `--peer-cert-file=peer.cert`, and use https as URL schema. -Similarly, to configure etcd with secure client communication, specify flags `--key-file=peer.key` and `--cert-file=peer.cert`, and use https as URL schema. +Similarly, to configure etcd with secure client communication, specify flags `--key-file=k8sclient.key` and `--cert-file=k8sclient.cert`, and use https as URL schema. ### Limiting access of etcd clusters After configuring secure communication, restrict the access of etcd cluster to only the Kubernetes API server. Use TLS authentication to do so. -For example, consider key pairs `k8sclient.key` and `k8sclient.cert` that are trusted by the CA `etcd.ca`. When etcd is configured with `--client-cert-auth` along with TLS, it verifies the certificates from clients by using system CAs or the CA passed in by `--trusted-ca-file` flag. Specifying flags `--client-cert-auth=true` and `--trust-ca-file=etcd.ca` will restrict the access to clients with the certificate `k8sclient.cert`. +For example, consider key pairs `k8sclient.key` and `k8sclient.cert` that are trusted by the CA `etcd.ca`. When etcd is configured with `--client-cert-auth` along with TLS, it verifies the certificates from clients by using system CAs or the CA passed in by `--trusted-ca-file` flag. Specifying flags `--client-cert-auth=true` and `--trusted-ca-file=etcd.ca` will restrict the access to clients with the certificate `k8sclient.cert`. Once etcd is configured correctly, only clients with valid certificates can access it. To give Kubernetes API server the access, configure it with the flags `--etcd-certfile=k8sclient.cert` and `--etcd-keyfile=k8sclient.key`.