From c5d8916092d0c5231febf20cc042ad4cda8758a7 Mon Sep 17 00:00:00 2001 From: Nils Hanke Date: Wed, 1 Jun 2022 16:27:15 +0200 Subject: [PATCH 1/2] Remove section about the removed localhost port --- .../concepts/security/controlling-access.md | 28 ------------------- 1 file changed, 28 deletions(-) diff --git a/content/en/docs/concepts/security/controlling-access.md b/content/en/docs/concepts/security/controlling-access.md index e7ba78e1c4..859246f186 100644 --- a/content/en/docs/concepts/security/controlling-access.md +++ b/content/en/docs/concepts/security/controlling-access.md @@ -136,34 +136,6 @@ The cluster audits the activities generated by users, by applications that use t For more information, see [Auditing](/docs/tasks/debug/debug-cluster/audit/). -## API server ports and IPs - -The previous discussion applies to requests sent to the secure port of the API server -(the typical case). The API server can actually serve on 2 ports: - -By default, the Kubernetes API server serves HTTP on 2 ports: - - 1. `localhost` port: - - - is intended for testing and bootstrap, and for other components of the master node - (scheduler, controller-manager) to talk to the API - - no TLS - - default is port 8080 - - default IP is localhost, change with `--insecure-bind-address` flag. - - request **bypasses** authentication and authorization modules. - - request handled by admission control module(s). - - protected by need to have host access - - 2. “Secure port”: - - - use whenever possible - - uses TLS. Set cert with `--tls-cert-file` and key with `--tls-private-key-file` flag. - - default is port 6443, change with `--secure-port` flag. - - default IP is first non-localhost network interface, change with `--bind-address` flag. - - request handled by authentication and authorization modules. - - request handled by admission control module(s). - - authentication and authorization modules run. - ## {{% heading "whatsnext" %}} Read more documentation on authentication, authorization and API access control: From 959cb922241c0817a489091776c92a2698b60bb5 Mon Sep 17 00:00:00 2001 From: Nils Hanke Date: Sat, 9 Jul 2022 04:55:43 -0700 Subject: [PATCH 2/2] Integrate flags into "Transport security" section --- content/en/docs/concepts/security/controlling-access.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/content/en/docs/concepts/security/controlling-access.md b/content/en/docs/concepts/security/controlling-access.md index 859246f186..c136038448 100644 --- a/content/en/docs/concepts/security/controlling-access.md +++ b/content/en/docs/concepts/security/controlling-access.md @@ -22,10 +22,11 @@ following diagram: ## Transport security -In a typical Kubernetes cluster, the API serves on port 443, protected by TLS. +By default, the Kubernetes API server listens on port 6443 on the first non-localhost network interface, protected by TLS. In a typical production Kubernetes cluster, the API serves on port 443. The port can be changed with the `--secure-port`, and the listening IP address with the `--bind-address` flag. + The API server presents a certificate. This certificate may be signed using a private certificate authority (CA), or based on a public key infrastructure linked -to a generally recognized CA. +to a generally recognized CA. The certificate and corresponding private key can be set by using the `--tls-cert-file` and `--tls-private-key-file` flags. If your cluster uses a private certificate authority, you need a copy of that CA certificate configured into your `~/.kube/config` on the client, so that you can