2016-02-11 00:55:31 +00:00
---
2017-08-03 23:22:52 +00:00
approvers:
2016-07-29 17:36:25 +00:00
- erictune
- lavalamp
2016-08-03 22:03:58 +00:00
- ericchiang
- deads2k
2016-11-15 02:09:57 +00:00
- liggitt
2016-12-15 20:16:54 +00:00
title: Authenticating
2016-02-11 00:55:31 +00:00
---
2016-12-15 20:16:54 +00:00
2016-11-21 22:07:09 +00:00
* TOC
{:toc}
2016-02-26 11:54:48 +00:00
2016-08-03 22:03:58 +00:00
## Users in Kubernetes
All Kubernetes clusters have two categories of users: service accounts managed
by Kubernetes, and normal users.
Normal users are assumed to be managed by an outside, independent service. An
admin distributing private keys, a user store like Keystone or Google Accounts,
even a file with a list of usernames and passwords. In this regard, _Kubernetes
does not have objects which represent normal user accounts._ Regular users
cannot be added to a cluster through an API call.
In contrast, service accounts are users managed by the Kubernetes API. They are
bound to specific namespaces, and created automatically by the API server or
manually through API calls. Service accounts are tied to a set of credentials
stored as `Secrets` , which are mounted into pods allowing in cluster processes
to talk to the Kubernetes API.
2016-09-28 21:19:08 +00:00
API requests are tied to either a normal user or a service account, or are treated
2017-01-16 13:12:43 +00:00
as anonymous requests. This means every process inside or outside the cluster, from
a human user typing `kubectl` on a workstation, to `kubelets` on nodes, to members
of the control plane, must authenticate when making requests to the API server,
2016-09-28 21:19:08 +00:00
or be treated as an anonymous user.
2016-08-03 22:03:58 +00:00
## Authentication strategies
2016-11-01 12:42:59 +00:00
Kubernetes uses client certificates, bearer tokens, an authenticating proxy, or HTTP basic auth to
2016-12-07 01:30:17 +00:00
authenticate API requests through authentication plugins. As HTTP requests are
made to the API server, plugins attempt to associate the following attributes
2016-08-03 22:03:58 +00:00
with the request:
* Username: a string which identifies the end user. Common values might be `kube-admin` or `jane@example.com` .
* UID: a string which identifies the end user and attempts to be more consistent and unique than username.
2017-08-11 02:29:25 +00:00
* Groups: a set of strings which associate users with a set of commonly grouped users.
2016-08-03 22:03:58 +00:00
* Extra fields: a map of strings to list of strings which holds additional information authorizers may find useful.
All values are opaque to the authentication system and only hold significance
when interpreted by an [authorizer ](/docs/admin/authorization/ ).
2016-08-25 16:30:56 +00:00
You can enable multiple authentication methods at once. You should usually use at least two methods:
- service account tokens for service accounts
- at least one other method for user authentication.
2017-06-22 23:16:58 +00:00
When multiple authenticator modules are enabled, the first module
2016-08-25 16:30:56 +00:00
to successfully authenticate the request short-circuits evaluation.
2016-08-03 22:03:58 +00:00
The API server does not guarantee the order authenticators run in.
2017-01-16 13:12:43 +00:00
The `system:authenticated` group is included in the list of groups for all authenticated users.
2016-09-28 21:19:08 +00:00
2017-08-09 20:16:03 +00:00
Integrations with other authentication protocols (LDAP, SAML, Kerberos, alternate x509 schemes, etc)
can be accomplished using an [authenticating proxy ](#authenticating-proxy ) or the
[authentication webhook ](#webhook-token-authentication ).
2016-08-03 22:03:58 +00:00
### X509 Client Certs
Client certificate authentication is enabled by passing the `--client-ca-file=SOMEFILE`
option to API server. The referenced file must contain one or more certificates authorities
to use to validate client certificates presented to the API server. If a client certificate
2016-02-26 11:54:48 +00:00
is presented and verified, the common name of the subject is used as the user name for the
2016-09-28 00:43:34 +00:00
request. As of Kubernetes 1.4, client certificates can also indicate a user's group memberships
using the certificate's organization fields. To include multiple group memberships for a user,
include multiple organization fields in the certificate.
For example, using the `openssl` command line tool to generate a certificate signing request:
``` bash
openssl req -new -key jbeda.pem -out jbeda-csr.pem -subj "/CN=jbeda/O=app1/O=app2"
```
This would create a CSR for the username "jbeda", belonging to two groups, "app1" and "app2".
2016-02-26 11:54:48 +00:00
2016-08-03 22:03:58 +00:00
See [APPENDIX ](#appendix ) for how to generate a client cert.
### Static Token File
2016-09-25 22:55:49 +00:00
The API server reads bearer tokens from a file when given the `--token-auth-file=SOMEFILE` option on the command line. Currently, tokens last indefinitely, and the token list cannot be
2016-08-03 22:03:58 +00:00
changed without restarting API server.
2016-02-26 11:54:48 +00:00
2017-02-21 04:45:50 +00:00
The token file is a csv file with a minimum of 3 columns: token, user name, user uid,
followed by optional group names. Note, if you have more than one group the column must be
double quoted e.g.
2016-03-06 12:26:30 +00:00
```conf
token,user,uid,"group1,group2,group3"
```
2016-02-26 11:54:48 +00:00
2016-09-25 22:55:49 +00:00
#### Putting a Bearer Token in a Request
When using bearer token authentication from an http client, the API
server expects an `Authorization` header with a value of `Bearer
THETOKEN`. The bearer token must be a character sequence that can be
put in an HTTP header value using no more than the encoding and
quoting facilities of HTTP. For example: if the bearer token is
`31ada4fd-adec-460c-809a-9e56ceb75269` then it would appear in an HTTP
header as shown below.
```http
2016-10-17 22:58:45 +00:00
Authorization: Bearer 31ada4fd-adec-460c-809a-9e56ceb75269
2016-09-25 22:55:49 +00:00
```
2016-02-26 11:54:48 +00:00
2017-03-10 03:13:12 +00:00
### Bootstrap Tokens
This feature is currently in **alpha** .
To allow for streamlined bootstrapping for new clusters, Kubernetes includes a
dynamically-managed Bearer token type called a *Bootstrap Token* . These tokens
are stored as Secrets in the `kube-system` namespace, where they can be
dynamically managed and created. Controller Manager contains a TokenCleaner
controller that deletes bootstrap tokens as they expire.
The tokens are of the form `[a-z0-9]{6}.[a-z0-9]{16}` . The first component is a
Token ID and the second component is the Token Secret. You specify the token
in an HTTP header as follows:
```http
Authorization: Bearer 781292.db7bc3a58fc5f07e
```
You must enable the Bootstrap Token Authenticator with the
`--experimental-bootstrap-token-auth` flag on the API Server. You must enable
the TokenCleaner controller via the `--controllers` flag on the Controller
Manager. This is done with something like `--controllers=*,tokencleaner` .
`kubeadm` will do this for you if you are using it to bootstrapping a cluster.
The authenticator authenticates as `system:bootstrap:<Token ID>` . It is
included in the `system:bootstrappers` group. The naming and groups are
intentionally limited to discourage users from using these tokens past
bootstrapping. The user names and group can be used (and are used by `kubeadm` )
to craft the appropriate authorization policies to support bootstrapping a
cluster.
Please see [Bootstrap Tokens ](/docs/admin/bootstrap-tokens/ ) for in depth
documentation on the Bootstrap Token authenticator and controllers along with
how to manage these tokens with `kubeadm` .
2016-08-03 22:03:58 +00:00
### Static Password File
2016-02-26 11:54:48 +00:00
2016-08-03 22:03:58 +00:00
Basic authentication is enabled by passing the `--basic-auth-file=SOMEFILE`
option to API server. Currently, the basic auth credentials last indefinitely,
and the password cannot be changed without restarting API server. Note that basic
2016-02-26 11:54:48 +00:00
authentication is currently supported for convenience while we finish making the
more secure modes described above easier to use.
2017-03-09 18:01:12 +00:00
The basic auth file is a csv file with a minimum of 3 columns: password, user name, user id.
2017-03-24 18:03:01 +00:00
In Kubernetes version 1.6 and later, you can specify an optional fourth column containing
comma-separated group names. If you have more than one group, you must enclose the fourth
2017-03-09 18:01:12 +00:00
column value in double quotes ("). See the following example:
2016-02-26 11:54:48 +00:00
2016-08-03 22:03:58 +00:00
```conf
2017-01-12 05:14:36 +00:00
password,user,uid,"group1,group2,group3"
2016-08-03 22:03:58 +00:00
```
When using basic authentication from an http client, the API server expects an `Authorization` header
2016-02-26 11:54:48 +00:00
with a value of `Basic BASE64ENCODED(USER:PASSWORD)` .
2016-08-03 22:03:58 +00:00
### Service Account Tokens
2017-09-16 00:30:05 +00:00
A service account is an automatically enabled authenticator that uses signed
2016-08-03 22:03:58 +00:00
bearer tokens to verify requests. The plugin takes two optional flags:
* `--service-account-key-file` A file containing a PEM encoded key for signing bearer tokens.
If unspecified, the API server's TLS private key will be used.
* `--service-account-lookup` If enabled, tokens which are deleted from the API will be revoked.
Service accounts are usually created automatically by the API server and
associated with pods running in the cluster through the `ServiceAccount`
[Admission Controller ](/docs/admin/admission-controllers/ ). Bearer tokens are
mounted into pods at well known locations, and allow in cluster processes to
talk to the API server. Accounts may be explicitly associated with pods using the
`serviceAccountName` field of a `PodSpec` .
NOTE: `serviceAccountName` is usually omitted because this is done automatically.
```
2017-03-24 18:03:01 +00:00
apiVersion: apps/v1beta1
2016-08-03 22:03:58 +00:00
kind: Deployment
metadata:
name: nginx-deployment
namespace: default
spec:
replicas: 3
template:
metadata:
# ...
spec:
containers:
- name: nginx
image: nginx:1.7.9
serviceAccountName: bob-the-bot
```
Service account bearer tokens are perfectly valid to use outside the cluster and
can be used to create identities for long standing jobs that wish to talk to the
Kubernetes API. To manually create a service account, simply use the `kubectl
create serviceaccount (NAME)` command. This creates a service account in the
current namespace and an associated secret.
```
$ kubectl create serviceaccount jenkins
serviceaccount "jenkins" created
$ kubectl get serviceaccounts jenkins -o yaml
apiVersion: v1
kind: ServiceAccount
metadata:
# ...
secrets:
- name: jenkins-token-1yvwg
```
The created secret holds the public CA of the API server and a signed JSON Web
Token (JWT).
```
$ kubectl get secret jenkins-token-1yvwg -o yaml
apiVersion: v1
data:
ca.crt: (APISERVER'S CA BASE64 ENCODED)
2017-09-01 08:34:07 +00:00
namespace: ZGVmYXVsdA==
2016-08-03 22:03:58 +00:00
token: (BEARER TOKEN BASE64 ENCODED)
kind: Secret
metadata:
# ...
type: kubernetes.io/service-account-token
```
Note: values are base64 encoded because secrets are always base64 encoded.
The signed JWT can be used as a bearer token to authenticate as the given service
2016-09-25 22:55:49 +00:00
account. See [above ](#putting-a-bearer-token-in-a-request ) for how the token is included
in a request. Normally these secrets are mounted into pods for in-cluster access to
2016-08-03 22:03:58 +00:00
the API server, but can be used from outside the cluster as well.
Service accounts authenticate with the username `system:serviceaccount:(NAMESPACE):(SERVICEACCOUNT)` ,
and are assigned to the groups `system:serviceaccounts` and `system:serviceaccounts:(NAMESPACE)` .
WARNING: Because service account tokens are stored in secrets, any user with
read access to those secrets can authenticate as the service account. Be cautious
when granting permissions to service accounts and read capabilities for secrets.
### OpenID Connect Tokens
[OpenID Connect ](https://openid.net/connect/ ) is a flavor of OAuth2 supported by
some OAuth2 providers, notably Azure Active Directory, Salesforce, and Google.
The protocol's main extension of OAuth2 is an additional field returned with
the access token called an [ID Token ](https://openid.net/specs/openid-connect-core-1_0.html#IDToken ).
This token is a JSON Web Token (JWT) with well known fields, such as a user's
2016-09-12 17:20:28 +00:00
email, signed by the server.
To identify the user, the authenticator uses the `id_token` (not the `access_token` )
from the OAuth2 [token response ](https://openid.net/specs/openid-connect-core-1_0.html#TokenResponse )
2016-09-25 22:55:49 +00:00
as a bearer token. See [above ](#putting-a-bearer-token-in-a-request ) for how the token
is included in a request.
2016-08-03 22:03:58 +00:00
2017-01-16 13:12:43 +00:00
2016-08-03 22:03:58 +00:00
2017-01-16 13:12:43 +00:00
1. Login to your identity provider
2. Your identity provider will provide you with an `access_token` , `id_token` and a `refresh_token`
3. When using `kubectl` , use your `id_token` with the `--token` flag or add it directly to your `kubeconfig`
4. `kubectl` sends your `id_token` in a header called Authorization to the API server
5. The API server will make sure the JWT signature is valid by checking against the certificate named in the configuration
6. Check to make sure the `id_token` hasn't expired
7. Make sure the user is authorized
8. Once authorized the API server returns a response to `kubectl`
9. `kubectl` provides feedback to the user
2016-08-25 16:30:56 +00:00
2017-01-16 13:12:43 +00:00
Since all of the data needed to validate who you are is in the `id_token` , Kubernetes doesn't need to
"phone home" to the identity provider. In a model where every request is stateless this provides a very scalable
solution for authentication. It does offer a few challenges:
2016-08-03 22:03:58 +00:00
2017-01-16 13:12:43 +00:00
1. Kubernetes has no "web interface" to trigger the authentication process. There is no browser or interface to collect credentials which is why you need to authenticate to your identity provider first.
2017-09-16 00:30:05 +00:00
2. The `id_token` can't be revoked, it's like a certificate so it should be short-lived (only a few minutes) so it can be very annoying to have to get a new token every few minutes.
3. There's no easy way to authenticate to the Kubernetes dashboard without using the `kubectl proxy` command or a reverse proxy that injects the `id_token` .
2016-08-03 22:03:58 +00:00
2017-01-16 13:12:43 +00:00
#### Configuring the API Server
2016-08-03 22:03:58 +00:00
2017-01-16 13:12:43 +00:00
To enable the plugin, configure the following flags on the API server:
2016-08-03 22:03:58 +00:00
2017-01-16 13:12:43 +00:00
| Parameter | Description | Example | Required |
| --------- | ----------- | ------- | ------- |
2017-09-05 21:28:47 +00:00
| `--oidc-issuer-url` | URL of the provider which allows the API server to discover public signing keys. Only URLs which use the `https://` scheme are accepted. This is typically the provider's discovery URL without a path, for example "https://accounts.google.com" or "https://login.salesforce.com". This URL should point to the level below .well-known/openid-configuration | If the discovery URL is `https://accounts.google.com/.well-known/openid-configuration` , the value should be `https://accounts.google.com` | Yes |
2017-02-02 14:07:57 +00:00
| `--oidc-client-id` | A client id that all tokens must be issued for. | kubernetes | Yes |
Move init containers to stable in v1.6 (#1939)
* Delete the parameter "--google-json-key string"
Delete the parameter "--google-json-key string"
* Fix apimachinery vendored dependencies in examples_test.
* package apt-transport-https should be installed
Ubuntu default install not include apt-transport-https. so if you want to download package from https repo, you need install apt-transport-https package first
* doc-walkthrough-content
modify
* limitrange-update
I think it's redundant that the second to ,in order to do sth and do
sth!thanks!
* fix command kubectl get svc,pod output
fix command kubectl get svc,pod output
* Fix typo: federation-controller-mananger => federation-controller-manager
* Fix typo: federation-controller-mananger => federation-controller-manager
* Clarify minimum version of kubernetes supporting PSP authz
* Provide correct location for KUBE_ETCD_SERVERS
Provide correct location for KUBE_ETCD_SERVERS configuration key. It was
previously listed as being in /etc/kubernetes/config but is actually in
/etc/kubernetes/apiserver.
Related: https://github.com/kubernetes/kubernetes.github.io/issues/1600
* Move Compute Resources topic to Concepts. (#2410)
* Delete the parameter "--google-json-key string"
“# kube-scheduler -help”can not find --google-json-key option
# kubectl version
Client Version: version.Info{Major:"1", Minor:"5", GitVersion:"v1.5.1+82450d0", GitCommit:"f5ef9802914a47c848fd84c287333f8b4d28bbc1", GitTreeState:"dirty", BuildDate:"2017-01-23T00:04:39Z", GoVersion:"go1.7", Compiler:"gc", Platform:"linux/amd64", USEEVersion:"V1.02.01_alpha", USEEPublishDate:"2017-1-10 00:00:00"}
Server Version: version.Info{Major:"1", Minor:"5", GitVersion:"v1.5.1+82450d0", GitCommit:"f5ef9802914a47c848fd84c287333f8b4d28bbc1", GitTreeState:"dirty", BuildDate:"2017-01-22T23:56:57Z", GoVersion:"go1.7", Compiler:"gc", Platform:"linux/amd64", USEEVersion:"V1.02.01_alpha", USEEPublishDate:"2017-1-10 00:00:00"}
* Add diagnose tips when you face problem.
* Update grammar for kubeadm.md, thanks @chenopis
* Merge two pieces to one words
* add http proxy infomation in kubeadm
* Update landing pages for Tasks and Tutorials. (#2634)
* Update static-pods.md
It works. Please review it again.
* Move Guide Topic: Multi-container pods. (#2642)
* fix link to go to pod-lifecycle page
* fix the command output
fix the command output
* mirantis_logo.png
,/images/community_logos/mirantis_logo.png updated per Mirantis request
* kubeadm reference -- /
set up/manage mean set up or manage ? it's better use or?
* Prototype for deprecating User Guide topic.
* missing word
The return of the OCD.
* Move Guide topic: Using Environment Variables. (#2645)
* fix typo (#2656)
fix typo
* Move Guide topic: Using Port Forwarding. (#2661)
* Move Guide topic: Bootstrapping Pet Sets. (#2662)
* Move Guide topic: Bootstrapping Pet Sets.
* Add TOC entry.
* Move Guide topic: Connect with Proxies. (#2663)
* Move Guide topic: Connect with Proxies.
* Fix link.
* add DefaultTolerationSeconds admission controller
* getting-started-guides: add CoreOS Tectonic
* Correct the certificate name
* Update index.md
* Update installation.md
* Update validation.md
* Update backups.md
* Update backups.md
* Spell fixes
* Using it vs Juju Kubernetes
* Q1 update to k8s tech and service partner list
New partners registered to K8s Partner Ecosystem sign-up form. Logo updates companion to this edit still WIP
* Logo file updates for new registrants
Logos for new registrants
* The attribute [allowfullscree] must have a value
Signed-off-by: yupengzte <yu.peng36@zte.com.cn>
* Remove newline before passing to base64
* Use single quote to avoid string interpolation, update output
* Update command as files contain no newline
* Remove all dead links, use just filename
As user can guess that it is file copied from the shown content
* Fix link to dev guide.
* Add --leader-elect=false
Second scheduler could not start without disabling leader-elect.
* cluster-components-could be running
could be doing sth
* update cluster-components.md
In theory,Master components can be run....
* update cluster-components--add a space
add a space after the comma: "In theory, Master components..."
* Highlighted command --kubectl describe
In web page ,there is no space ,need some empty space,thanks!
* Revert "Highlighted command --kubectl describe"
This reverts commit a70d0a3e3537c3f91b197b23f949e1e506c951d1.
* Add example show how to configure proxy for kube
* Revision as the suggestion describe
* move ha-master-gce.png to images/docs
Signed-off-by: Xiuyu Li <nickleefly@gmail.com>
* use relative path for ha-master-gce image
Signed-off-by: Xiuyu Li <nickleefly@gmail.com>
* The attribute [calendarWrapper] must be unique
Signed-off-by: yupengzte <yu.peng36@zte.com.cn>
* add required images in kubeadm init step
* Add links to Docker/rtk in cluster-intro.html
* s/acomplish/accomplish/
* Modify the link URL of [kubelet eviction design doc]
[kubelet eviction design doc] should be linked to kubernetes.github.io
instead of community/design-proposal.
* fix CronJob object name
fix CronJob object name
* remove redundant a
Signed-off-by: Xiuyu Li <nickleefly@gmail.com>
* kubeadm reference--change any to some (#2683)
* modify one word
examples to example
* doc-walkthrough-content
modify
* limitrange-update
I think it's redundant that the second to ,in order to do sth and do
sth!thanks!
* cluster-components-could be running
could be doing sth
* update cluster-components.md
In theory,Master components can be run....
* update cluster-components--add a space
add a space after the comma: "In theory, Master components..."
* Highlighted command --kubectl describe
In web page ,there is no space ,need some empty space,thanks!
* Revert "Highlighted command --kubectl describe"
This reverts commit a70d0a3e3537c3f91b197b23f949e1e506c951d1.
* kubeadm reference--change any to some
kubeadm can install any add-on ?
* Move Guide topics: Logging (#2687)
* Disallow indexing for liveness/index (#2689)
* Deprecate Guide topics. (#2691)
* Wrong label and kubectl get completed pods
The label `app=jobexample` should be `jobgroup=jobexample`.
Also, for get completed pods the flag `--show-all` is necessary.
* Update garbage-collection.md
change “any” to "every"
* Deprecate Guide topic: Persistent Volume Walkthrough. (#2692)
* Reimplement PR #2525
Fixes typo by removing the word "controller"
* remove extra space
* Update multiple-schedulers doc (#2063)
* Update tutorial
* Fix md formatting.
* Remove extraneous space
* Deprecate Guide topic: Secrets Walkthrough. (#2695)
* Deprecate Guide topics: quick-start ... (#2696)
* Update Tasks landing page. (#2697)
* Remove redundant section in deployments
The status of the deployment is already covered in a later section in
this doc.
* Repair Spotinst logo
Corrected size
* fixed ASM blurb
* Correct ASM logo filename
* Highlighted command for `kubectl proxy`.
* Update ubuntu install instructions.
* Update local instructions to new method.
* update init-containers.md
add one word.
* Minor spelling correction -- "rtk" to "rkt"
* fixing typo
* Doc formatting update
Corrected indentation for the `nonResourcePath` and got a bit zealous with restructuring that section...
* Repair Spotinst logo
Corrected size
* fixed ASM blurb
* Correct ASM logo filename
* Update garbage-collection.md
change "any" to "every"
* Update Weave Net's title.
* fix unsupported parameter of wget command
* update to be retained
change "retain" to "to be retained".
* Update pod.md
* update init-containers.md
change "a different filesystem view" to "different filesystem views".
different init container should have different filesystem.
* Highlighted command --kubectl describe
In web page ,there is no space ,need some empty space,thanks!
* cluster-management--3
change 3 to three is better or not ?thanks!
* fix typo
1、Parameters “--allow-verification-with-non-compliant-keys” is missed.
2、Delete the parameter "--google-json-key string";
see the "# kube-controller-manager -help"
# kubectl version
Client Version: version.Info{Major:"1", Minor:"5", GitVersion:"v1.5.1+82450d0", GitCommit:"f5ef9802914a47c848fd84c287333f8b4d28bbc1", GitTreeState:"dirty", BuildDate:"2017-01-23T00:04:39Z", GoVersion:"go1.7", Compiler:"gc", Platform:"linux/amd64", USEEVersion:"V1.02.01_alpha", USEEPublishDate:"2017-1-10 00:00:00"}
Server Version: version.Info{Major:"1", Minor:"5", GitVersion:"v1.5.1+82450d0", GitCommit:"f5ef9802914a47c848fd84c287333f8b4d28bbc1", GitTreeState:"dirty", BuildDate:"2017-01-22T23:56:57Z", GoVersion:"go1.7", Compiler:"gc", Platform:"linux/amd64", USEEVersion:"V1.02.01_alpha", USEEPublishDate:"2017-1-10 00:00:00"}
* fix typo
1、Delete the parameter "--google-json-key string";
2、Parameters "--ir-data-source string"、"--ir-dbname string"、"--ir-hawkular string"、"--ir-influxdb-host string"、"--ir-namespace-only"、"--ir-password string"、"--ir-percentile int"、"--ir-user string" is missed.
see the "# kube-prxoy -help"
# kubectl version
Client Version: version.Info{Major:"1", Minor:"5", GitVersion:"v1.5.1+82450d0", GitCommit:"f5ef9802914a47c848fd84c287333f8b4d28bbc1", GitTreeState:"dirty", BuildDate:"2017-01-23T00:04:39Z", GoVersion:"go1.7", Compiler:"gc", Platform:"linux/amd64", USEEVersion:"V1.02.01_alpha", USEEPublishDate:"2017-1-10 00:00:00"}
Server Version: version.Info{Major:"1", Minor:"5", GitVersion:"v1.5.1+82450d0", GitCommit:"f5ef9802914a47c848fd84c287333f8b4d28bbc1", GitTreeState:"dirty", BuildDate:"2017-01-22T23:56:57Z", GoVersion:"go1.7", Compiler:"gc", Platform:"linux/amd64", USEEVersion:"V1.02.01_alpha", USEEPublishDate:"2017-1-10 00:00:00"}
* Update garbage-collection.md
modify the url and link
* update garbage-collection.md
change the url to relative path.
* update out-of-resource.md
change "in cases when" to "in case that"
* update out-of-resource.md
use a shorter and simpler expression.
* update out-of-resource.md
change "support" to "supports"
* Create a top-level CN directory to hold future md files for the Chinese kubernetes site
* Removed `=` at the end of the flags.
* Remove autogenerate todo
- This should be captured via a GitHub issue
and not a TODO in the README documentation
which leads to confusion.
* Move Guide topics: Federation Tasks. (#2799)
* Move Guide topics: Federation tutorial and concept. (#2802)
* Move Guide topics: Federation tutorial and concept.
* Add title.
* Fix link.
* Move kubectl Concept topics to Tutorials. (#2804)
* Move kubectl Concept topics to Tutorials.
* Add redirects and update links.
* The calendarWrapper attribute should be unique
Signed-off-by: yupengzte <yu.peng36@zte.com.cn>
* Fix links. (#2808)
* Fix link. (#2806)
* Move topic from clusters to cluster-administration. (#2812)
* Move a batch of cluster admin topics. (#2813)
* Move Guide topic: Limit storage consumption. (#2814)
* Move Guide topic: Limit storage consumption.
* Add title.
* Move Guide topic: Networking. (#2816)
* Move Guide topic: Network Plugins. (#2819)
* Move Guide topic: Network Plugins.
* Fix link.
* Move Guide topic: Static Pods. (#2820)
* User Guide content migration: post notice (#2818)
* Add User Guide content migration notice.
* Fix formatting
* Tweek formatting to block highlight text in light gray.
* Try table instead of code block
* remove extra lines
* try table format
* fix links
* incorporate @ddonnelly feedback
* Move Guide topic: Out of Resource. (#2821)
* Move Guide topic: Monitoring Node Health. (#2822)
* Move Guide topic: Monitoring Node Health.
* Move to Tasks.
* Move Guide topic: AppArmor. (#2823)
* Apparmor (#2825)
* Move Guide topic: AppArmor.
* Add included files.
* Move Guide topic: Audit. (#2824)
* Added 1.6 Upgrade notes to outline changes for etcd 3.
* Move Guide topic: Disruption Budget. (#2834)
* Move Guide topic: Limit range. (#2835)
* Quota (#2836)
* Move Guide topic: Limit range.
* Move Guide topic: Resource Quota and Limits.
* Quota2 (#2838)
* Move Guide topic: Limit range.
* Move Guide topic: Resource Quota concept.
* Dns (#2839)
* Move Guide topic: Limit range.
* Move Guide topic: DNS.
* Delete CNAME
* Create CNAME
* Delete CNAME
* Create CNAME
* Move docs/user-guide/managing-deployments.md to /docs/concepts/cluster-administration/manage-deployment.md
* add nginx-app.yaml file
* add back missing /
* fix link
* Move Guide topic: Replication Controller Operations
* Move Guide topic: Resizing a replication controller
* Concepts toc (#2840)
* Move Guide topic: Limit range.
* Adjust Concepts Overview TOC.
* Move Guide topic: Rolling Updates
* Move Kubernetes API page. (#2849)
* Move What is Kubernetes topic. (#2851)
* Move Guide topic: Rolling Update Demo (#2850)
* Move Guide topic: Rolling Update Demo
* rename file
* Move Guide topic: Configuration Best Practices
* Move Guide topic: Jobs (#2853)
* Move Guide topic: Jobs
* add job.yaml file
* change title
* Move Pod overview. (#2865)
* Move Pod overview.
* Fix redirection.
* Move Guide topic: Parallel Processing using Expansions (#2867)
* Move Guide topic: Parallel Processing using Expansions
* fix links to /docs/user-guide/jobs/
* Move Init Containers topic. (#2866)
* Move Guide topic: Coarse Parallel Processing Using a Work Queue
* Move Guide topic: Fine Parallel Processing using a Work Queue (#2870)
* Move Guide topic: Fine Parallel Processing using a Work Queue
* add migration notice
* fixed capitalization
* Rename /docs/tasks/job/work-queue-1/
* Move StatefulSets topic. (#2869)
* Move StatefulSets topic.
* Fix TOC.
* Move Guide topic: Pod Templates (#2872)
* Move Guide topic: Pod Templates
* tweak header level and capitalization
* Move PetSets topic. (#2873)
* Move Garbage Collection topic. (#2874)
* Move Garbage Collection topic.
* Fix included file.
* Move Guide topic: Prereqs
* Move Guide topic: Sharing Clusters
* Move Accessing Clusters topic to Concepts. (#2875)
* Move Accessing Clusters topic to Concepts.
* Update concepts.yml
* Move Guide topic: Kubeconfig File
* Move Guide topic: Config Provider Firewalls. (#2883)
* Move Guide topic: Federation Service Discovery. (#2884)
* Move Guide topic: Connecting Apps with Services. (#2885)
* Added example and docu for hostPort ranges
* Move Guide topic: Service. (#2891)
* Move Guide topic: Service.
* Move Guide topic: External Load Balancer.
* Fix TOC.
* Move Guide topic: Resource Monitoring. (#2895)
* docs/admin: document OpenID Connect plugin's claim prefixing
* Move Guide topic: Admin Guide
* fix the command output
fix the command output
* Update manage-compute-resources-container.md
Change "he" to "The"
* update out-of-resource.md
change "thresholds" to "threshold"
* update init-containers.md
change "apply" to "application"
* amend monitor-node-health.md
Amend the url link.
* Fix monitor-node-health.md
The url link does not exist.
* fix a typo in /docs/user-guide/configmap/index.md
change "value" to "values"
* View $PAGE on Github without forking the repo
Adding a "View docs/bla-bla.md on GitHub" button next to the
"Edit docs/bla-bla.md" button so that people can view the file
first without clicking the Edit button (which does not work without
forking the repository).
I did not need this because I was trying to do something without
forking. I just found it to be bit difficult to view source of a page
on GitHub.
I'm open to ideas, perhaps we can instead add an article footer button
named "View on GitHub" next to the "Edit this Page".
Signed-off-by: Ahmet Alp Balkan <ahmetb@google.com>
* Move Guide topics: Container Lifestyle Hooks, Images, Volumes
* fix to taint the master node
* Add files via upload
* fix the link of ogging-elasticsearch-kibana.md
fix the link of url
* Remove from TOC/Search: pods/init-containers ... (#2694)
* Fix typo
* Add files via upload
* Create hyperlink
Create hyperlink for kubernetes repo link.
* updated PSP documentation with RBAC (#2552)
Added info about controller manager setup and current implementation when using PSP with RBAC support.
* Use kubectl config current-context to simplify the instructions
* fix typeo (#2856)
* fix typeo
* Update kargo.md
* Fix typo in kubectl_completion.md
evaluation --> evaluated
* Apply typo fixes from #2791 (#2949)
* Apply typo fixes from #2791
* remove style typos
* Fix the typos
Signed-off-by: yupengzte <yu.peng36@zte.com.cn>
* Fix typo
* Fix typo (#2842)
2017-03-22 01:13:33 +00:00
| `--oidc-username-claim` | JWT claim to use as the user name. By default `sub` , which is expected to be a unique identifier of the end user. Admins can choose other claims, such as `email` or `name` , depending on their provider. However, claims other than `email` will be prefixed with the issuer URL to prevent naming clashes with other plugins. | sub | No |
2017-02-02 14:07:57 +00:00
| `--oidc-groups-claim` | JWT claim to use as the user's group. If the claim is present it must be an array of strings. | groups | No |
| `--oidc-ca-file` | The path to the certificate for the CA that signed your identity provider's web certificate. Defaults to the host's root CAs. | `/etc/kubernetes/ssl/kc-ca.pem` | No |
2017-01-16 13:12:43 +00:00
Move init containers to stable in v1.6 (#1939)
* Delete the parameter "--google-json-key string"
Delete the parameter "--google-json-key string"
* Fix apimachinery vendored dependencies in examples_test.
* package apt-transport-https should be installed
Ubuntu default install not include apt-transport-https. so if you want to download package from https repo, you need install apt-transport-https package first
* doc-walkthrough-content
modify
* limitrange-update
I think it's redundant that the second to ,in order to do sth and do
sth!thanks!
* fix command kubectl get svc,pod output
fix command kubectl get svc,pod output
* Fix typo: federation-controller-mananger => federation-controller-manager
* Fix typo: federation-controller-mananger => federation-controller-manager
* Clarify minimum version of kubernetes supporting PSP authz
* Provide correct location for KUBE_ETCD_SERVERS
Provide correct location for KUBE_ETCD_SERVERS configuration key. It was
previously listed as being in /etc/kubernetes/config but is actually in
/etc/kubernetes/apiserver.
Related: https://github.com/kubernetes/kubernetes.github.io/issues/1600
* Move Compute Resources topic to Concepts. (#2410)
* Delete the parameter "--google-json-key string"
“# kube-scheduler -help”can not find --google-json-key option
# kubectl version
Client Version: version.Info{Major:"1", Minor:"5", GitVersion:"v1.5.1+82450d0", GitCommit:"f5ef9802914a47c848fd84c287333f8b4d28bbc1", GitTreeState:"dirty", BuildDate:"2017-01-23T00:04:39Z", GoVersion:"go1.7", Compiler:"gc", Platform:"linux/amd64", USEEVersion:"V1.02.01_alpha", USEEPublishDate:"2017-1-10 00:00:00"}
Server Version: version.Info{Major:"1", Minor:"5", GitVersion:"v1.5.1+82450d0", GitCommit:"f5ef9802914a47c848fd84c287333f8b4d28bbc1", GitTreeState:"dirty", BuildDate:"2017-01-22T23:56:57Z", GoVersion:"go1.7", Compiler:"gc", Platform:"linux/amd64", USEEVersion:"V1.02.01_alpha", USEEPublishDate:"2017-1-10 00:00:00"}
* Add diagnose tips when you face problem.
* Update grammar for kubeadm.md, thanks @chenopis
* Merge two pieces to one words
* add http proxy infomation in kubeadm
* Update landing pages for Tasks and Tutorials. (#2634)
* Update static-pods.md
It works. Please review it again.
* Move Guide Topic: Multi-container pods. (#2642)
* fix link to go to pod-lifecycle page
* fix the command output
fix the command output
* mirantis_logo.png
,/images/community_logos/mirantis_logo.png updated per Mirantis request
* kubeadm reference -- /
set up/manage mean set up or manage ? it's better use or?
* Prototype for deprecating User Guide topic.
* missing word
The return of the OCD.
* Move Guide topic: Using Environment Variables. (#2645)
* fix typo (#2656)
fix typo
* Move Guide topic: Using Port Forwarding. (#2661)
* Move Guide topic: Bootstrapping Pet Sets. (#2662)
* Move Guide topic: Bootstrapping Pet Sets.
* Add TOC entry.
* Move Guide topic: Connect with Proxies. (#2663)
* Move Guide topic: Connect with Proxies.
* Fix link.
* add DefaultTolerationSeconds admission controller
* getting-started-guides: add CoreOS Tectonic
* Correct the certificate name
* Update index.md
* Update installation.md
* Update validation.md
* Update backups.md
* Update backups.md
* Spell fixes
* Using it vs Juju Kubernetes
* Q1 update to k8s tech and service partner list
New partners registered to K8s Partner Ecosystem sign-up form. Logo updates companion to this edit still WIP
* Logo file updates for new registrants
Logos for new registrants
* The attribute [allowfullscree] must have a value
Signed-off-by: yupengzte <yu.peng36@zte.com.cn>
* Remove newline before passing to base64
* Use single quote to avoid string interpolation, update output
* Update command as files contain no newline
* Remove all dead links, use just filename
As user can guess that it is file copied from the shown content
* Fix link to dev guide.
* Add --leader-elect=false
Second scheduler could not start without disabling leader-elect.
* cluster-components-could be running
could be doing sth
* update cluster-components.md
In theory,Master components can be run....
* update cluster-components--add a space
add a space after the comma: "In theory, Master components..."
* Highlighted command --kubectl describe
In web page ,there is no space ,need some empty space,thanks!
* Revert "Highlighted command --kubectl describe"
This reverts commit a70d0a3e3537c3f91b197b23f949e1e506c951d1.
* Add example show how to configure proxy for kube
* Revision as the suggestion describe
* move ha-master-gce.png to images/docs
Signed-off-by: Xiuyu Li <nickleefly@gmail.com>
* use relative path for ha-master-gce image
Signed-off-by: Xiuyu Li <nickleefly@gmail.com>
* The attribute [calendarWrapper] must be unique
Signed-off-by: yupengzte <yu.peng36@zte.com.cn>
* add required images in kubeadm init step
* Add links to Docker/rtk in cluster-intro.html
* s/acomplish/accomplish/
* Modify the link URL of [kubelet eviction design doc]
[kubelet eviction design doc] should be linked to kubernetes.github.io
instead of community/design-proposal.
* fix CronJob object name
fix CronJob object name
* remove redundant a
Signed-off-by: Xiuyu Li <nickleefly@gmail.com>
* kubeadm reference--change any to some (#2683)
* modify one word
examples to example
* doc-walkthrough-content
modify
* limitrange-update
I think it's redundant that the second to ,in order to do sth and do
sth!thanks!
* cluster-components-could be running
could be doing sth
* update cluster-components.md
In theory,Master components can be run....
* update cluster-components--add a space
add a space after the comma: "In theory, Master components..."
* Highlighted command --kubectl describe
In web page ,there is no space ,need some empty space,thanks!
* Revert "Highlighted command --kubectl describe"
This reverts commit a70d0a3e3537c3f91b197b23f949e1e506c951d1.
* kubeadm reference--change any to some
kubeadm can install any add-on ?
* Move Guide topics: Logging (#2687)
* Disallow indexing for liveness/index (#2689)
* Deprecate Guide topics. (#2691)
* Wrong label and kubectl get completed pods
The label `app=jobexample` should be `jobgroup=jobexample`.
Also, for get completed pods the flag `--show-all` is necessary.
* Update garbage-collection.md
change “any” to "every"
* Deprecate Guide topic: Persistent Volume Walkthrough. (#2692)
* Reimplement PR #2525
Fixes typo by removing the word "controller"
* remove extra space
* Update multiple-schedulers doc (#2063)
* Update tutorial
* Fix md formatting.
* Remove extraneous space
* Deprecate Guide topic: Secrets Walkthrough. (#2695)
* Deprecate Guide topics: quick-start ... (#2696)
* Update Tasks landing page. (#2697)
* Remove redundant section in deployments
The status of the deployment is already covered in a later section in
this doc.
* Repair Spotinst logo
Corrected size
* fixed ASM blurb
* Correct ASM logo filename
* Highlighted command for `kubectl proxy`.
* Update ubuntu install instructions.
* Update local instructions to new method.
* update init-containers.md
add one word.
* Minor spelling correction -- "rtk" to "rkt"
* fixing typo
* Doc formatting update
Corrected indentation for the `nonResourcePath` and got a bit zealous with restructuring that section...
* Repair Spotinst logo
Corrected size
* fixed ASM blurb
* Correct ASM logo filename
* Update garbage-collection.md
change "any" to "every"
* Update Weave Net's title.
* fix unsupported parameter of wget command
* update to be retained
change "retain" to "to be retained".
* Update pod.md
* update init-containers.md
change "a different filesystem view" to "different filesystem views".
different init container should have different filesystem.
* Highlighted command --kubectl describe
In web page ,there is no space ,need some empty space,thanks!
* cluster-management--3
change 3 to three is better or not ?thanks!
* fix typo
1、Parameters “--allow-verification-with-non-compliant-keys” is missed.
2、Delete the parameter "--google-json-key string";
see the "# kube-controller-manager -help"
# kubectl version
Client Version: version.Info{Major:"1", Minor:"5", GitVersion:"v1.5.1+82450d0", GitCommit:"f5ef9802914a47c848fd84c287333f8b4d28bbc1", GitTreeState:"dirty", BuildDate:"2017-01-23T00:04:39Z", GoVersion:"go1.7", Compiler:"gc", Platform:"linux/amd64", USEEVersion:"V1.02.01_alpha", USEEPublishDate:"2017-1-10 00:00:00"}
Server Version: version.Info{Major:"1", Minor:"5", GitVersion:"v1.5.1+82450d0", GitCommit:"f5ef9802914a47c848fd84c287333f8b4d28bbc1", GitTreeState:"dirty", BuildDate:"2017-01-22T23:56:57Z", GoVersion:"go1.7", Compiler:"gc", Platform:"linux/amd64", USEEVersion:"V1.02.01_alpha", USEEPublishDate:"2017-1-10 00:00:00"}
* fix typo
1、Delete the parameter "--google-json-key string";
2、Parameters "--ir-data-source string"、"--ir-dbname string"、"--ir-hawkular string"、"--ir-influxdb-host string"、"--ir-namespace-only"、"--ir-password string"、"--ir-percentile int"、"--ir-user string" is missed.
see the "# kube-prxoy -help"
# kubectl version
Client Version: version.Info{Major:"1", Minor:"5", GitVersion:"v1.5.1+82450d0", GitCommit:"f5ef9802914a47c848fd84c287333f8b4d28bbc1", GitTreeState:"dirty", BuildDate:"2017-01-23T00:04:39Z", GoVersion:"go1.7", Compiler:"gc", Platform:"linux/amd64", USEEVersion:"V1.02.01_alpha", USEEPublishDate:"2017-1-10 00:00:00"}
Server Version: version.Info{Major:"1", Minor:"5", GitVersion:"v1.5.1+82450d0", GitCommit:"f5ef9802914a47c848fd84c287333f8b4d28bbc1", GitTreeState:"dirty", BuildDate:"2017-01-22T23:56:57Z", GoVersion:"go1.7", Compiler:"gc", Platform:"linux/amd64", USEEVersion:"V1.02.01_alpha", USEEPublishDate:"2017-1-10 00:00:00"}
* Update garbage-collection.md
modify the url and link
* update garbage-collection.md
change the url to relative path.
* update out-of-resource.md
change "in cases when" to "in case that"
* update out-of-resource.md
use a shorter and simpler expression.
* update out-of-resource.md
change "support" to "supports"
* Create a top-level CN directory to hold future md files for the Chinese kubernetes site
* Removed `=` at the end of the flags.
* Remove autogenerate todo
- This should be captured via a GitHub issue
and not a TODO in the README documentation
which leads to confusion.
* Move Guide topics: Federation Tasks. (#2799)
* Move Guide topics: Federation tutorial and concept. (#2802)
* Move Guide topics: Federation tutorial and concept.
* Add title.
* Fix link.
* Move kubectl Concept topics to Tutorials. (#2804)
* Move kubectl Concept topics to Tutorials.
* Add redirects and update links.
* The calendarWrapper attribute should be unique
Signed-off-by: yupengzte <yu.peng36@zte.com.cn>
* Fix links. (#2808)
* Fix link. (#2806)
* Move topic from clusters to cluster-administration. (#2812)
* Move a batch of cluster admin topics. (#2813)
* Move Guide topic: Limit storage consumption. (#2814)
* Move Guide topic: Limit storage consumption.
* Add title.
* Move Guide topic: Networking. (#2816)
* Move Guide topic: Network Plugins. (#2819)
* Move Guide topic: Network Plugins.
* Fix link.
* Move Guide topic: Static Pods. (#2820)
* User Guide content migration: post notice (#2818)
* Add User Guide content migration notice.
* Fix formatting
* Tweek formatting to block highlight text in light gray.
* Try table instead of code block
* remove extra lines
* try table format
* fix links
* incorporate @ddonnelly feedback
* Move Guide topic: Out of Resource. (#2821)
* Move Guide topic: Monitoring Node Health. (#2822)
* Move Guide topic: Monitoring Node Health.
* Move to Tasks.
* Move Guide topic: AppArmor. (#2823)
* Apparmor (#2825)
* Move Guide topic: AppArmor.
* Add included files.
* Move Guide topic: Audit. (#2824)
* Added 1.6 Upgrade notes to outline changes for etcd 3.
* Move Guide topic: Disruption Budget. (#2834)
* Move Guide topic: Limit range. (#2835)
* Quota (#2836)
* Move Guide topic: Limit range.
* Move Guide topic: Resource Quota and Limits.
* Quota2 (#2838)
* Move Guide topic: Limit range.
* Move Guide topic: Resource Quota concept.
* Dns (#2839)
* Move Guide topic: Limit range.
* Move Guide topic: DNS.
* Delete CNAME
* Create CNAME
* Delete CNAME
* Create CNAME
* Move docs/user-guide/managing-deployments.md to /docs/concepts/cluster-administration/manage-deployment.md
* add nginx-app.yaml file
* add back missing /
* fix link
* Move Guide topic: Replication Controller Operations
* Move Guide topic: Resizing a replication controller
* Concepts toc (#2840)
* Move Guide topic: Limit range.
* Adjust Concepts Overview TOC.
* Move Guide topic: Rolling Updates
* Move Kubernetes API page. (#2849)
* Move What is Kubernetes topic. (#2851)
* Move Guide topic: Rolling Update Demo (#2850)
* Move Guide topic: Rolling Update Demo
* rename file
* Move Guide topic: Configuration Best Practices
* Move Guide topic: Jobs (#2853)
* Move Guide topic: Jobs
* add job.yaml file
* change title
* Move Pod overview. (#2865)
* Move Pod overview.
* Fix redirection.
* Move Guide topic: Parallel Processing using Expansions (#2867)
* Move Guide topic: Parallel Processing using Expansions
* fix links to /docs/user-guide/jobs/
* Move Init Containers topic. (#2866)
* Move Guide topic: Coarse Parallel Processing Using a Work Queue
* Move Guide topic: Fine Parallel Processing using a Work Queue (#2870)
* Move Guide topic: Fine Parallel Processing using a Work Queue
* add migration notice
* fixed capitalization
* Rename /docs/tasks/job/work-queue-1/
* Move StatefulSets topic. (#2869)
* Move StatefulSets topic.
* Fix TOC.
* Move Guide topic: Pod Templates (#2872)
* Move Guide topic: Pod Templates
* tweak header level and capitalization
* Move PetSets topic. (#2873)
* Move Garbage Collection topic. (#2874)
* Move Garbage Collection topic.
* Fix included file.
* Move Guide topic: Prereqs
* Move Guide topic: Sharing Clusters
* Move Accessing Clusters topic to Concepts. (#2875)
* Move Accessing Clusters topic to Concepts.
* Update concepts.yml
* Move Guide topic: Kubeconfig File
* Move Guide topic: Config Provider Firewalls. (#2883)
* Move Guide topic: Federation Service Discovery. (#2884)
* Move Guide topic: Connecting Apps with Services. (#2885)
* Added example and docu for hostPort ranges
* Move Guide topic: Service. (#2891)
* Move Guide topic: Service.
* Move Guide topic: External Load Balancer.
* Fix TOC.
* Move Guide topic: Resource Monitoring. (#2895)
* docs/admin: document OpenID Connect plugin's claim prefixing
* Move Guide topic: Admin Guide
* fix the command output
fix the command output
* Update manage-compute-resources-container.md
Change "he" to "The"
* update out-of-resource.md
change "thresholds" to "threshold"
* update init-containers.md
change "apply" to "application"
* amend monitor-node-health.md
Amend the url link.
* Fix monitor-node-health.md
The url link does not exist.
* fix a typo in /docs/user-guide/configmap/index.md
change "value" to "values"
* View $PAGE on Github without forking the repo
Adding a "View docs/bla-bla.md on GitHub" button next to the
"Edit docs/bla-bla.md" button so that people can view the file
first without clicking the Edit button (which does not work without
forking the repository).
I did not need this because I was trying to do something without
forking. I just found it to be bit difficult to view source of a page
on GitHub.
I'm open to ideas, perhaps we can instead add an article footer button
named "View on GitHub" next to the "Edit this Page".
Signed-off-by: Ahmet Alp Balkan <ahmetb@google.com>
* Move Guide topics: Container Lifestyle Hooks, Images, Volumes
* fix to taint the master node
* Add files via upload
* fix the link of ogging-elasticsearch-kibana.md
fix the link of url
* Remove from TOC/Search: pods/init-containers ... (#2694)
* Fix typo
* Add files via upload
* Create hyperlink
Create hyperlink for kubernetes repo link.
* updated PSP documentation with RBAC (#2552)
Added info about controller manager setup and current implementation when using PSP with RBAC support.
* Use kubectl config current-context to simplify the instructions
* fix typeo (#2856)
* fix typeo
* Update kargo.md
* Fix typo in kubectl_completion.md
evaluation --> evaluated
* Apply typo fixes from #2791 (#2949)
* Apply typo fixes from #2791
* remove style typos
* Fix the typos
Signed-off-by: yupengzte <yu.peng36@zte.com.cn>
* Fix typo
* Fix typo (#2842)
2017-03-22 01:13:33 +00:00
If a claim other than `email` is chosen for `--oidc-username-claim` , the value
will be prefixed with the `--oidc-issuer-url` to prevent clashes with existing
Kubernetes names (such as the `system:` users). For example, if the provider
URL is `https://accounts.google.com` and the username claim maps to `jane` , the
plugin will authenticate the user as:
```
https://accounts.google.com#jane
```
2017-01-16 13:12:43 +00:00
Importantly, the API server is not an OAuth2 client, rather it can only be
configured to trust a single issuer. This allows the use of public providers,
such as Google, without trusting credentials issued to third parties. Admins who
wish to utilize multiple OAuth clients should explore providers which support the
`azp` (authorized party) claim, a mechanism for allowing one client to issue
tokens on behalf of another.
2016-08-03 22:03:58 +00:00
2016-08-25 16:30:56 +00:00
Kubernetes does not provide an OpenID Connect Identity Provider.
You can use an existing public OpenID Connect Identity Provider (such as Google, or [others ](http://connect2id.com/products/nimbus-oauth-openid-connect-sdk/openid-connect-providers )).
2017-01-16 13:12:43 +00:00
Or, you can run your own Identity Provider, such as CoreOS [dex ](https://github.com/coreos/dex ), [Keycloak ](https://github.com/keycloak/keycloak ), CloudFoundry [UAA ](https://github.com/cloudfoundry/uaa ), or Tremolo Security's [OpenUnison ](https://github.com/tremolosecurity/openunison ).
For an identity provider to work with Kubernetes it must:
2016-08-25 16:30:56 +00:00
2017-01-16 13:12:43 +00:00
1. Support [OpenID connect discovery ](https://openid.net/specs/openid-connect-discovery-1_0.html ); not all do.
2. Run in TLS with non-obsolete ciphers
3. Have a CA signed certificate (even if the CA is not a commercial CA or is self signed)
2017-09-05 21:28:47 +00:00
A note about requirement #3 above, requiring a CA signed certificate. If you deploy your own identity provider (as opposed to one of the cloud providers like Google or Microsoft) you MUST have your identity provider's web server certificate signed by a certificate with the `CA` flag set to `TRUE` , even if it is self signed. This is due to GoLang's TLS client implementation being very strict to the standards around certificate validation. If you don't have a CA handy, you can use [this script ](https://github.com/coreos/dex/blob/1ee5920c54f5926d6468d2607c728b71cfe98092/examples/k8s/gencert.sh ) from the CoreOS team to create a simple CA and a signed certificate and key pair.
Or you can use [this similar script ](https://raw.githubusercontent.com/TremoloSecurity/openunison-qs-kubernetes/master/makecerts.sh ) that generates SHA256 certs with a longer life and larger key size.
2016-08-25 16:30:56 +00:00
Setup instructions for specific systems:
2016-09-12 17:20:28 +00:00
- [UAA ](http://apigee.com/about/blog/engineering/kubernetes-authentication-enterprise )
- [Dex ](https://speakerdeck.com/ericchiang/kubernetes-access-control-with-dex )
2017-01-16 13:12:43 +00:00
- [OpenUnison ](https://github.com/TremoloSecurity/openunison-qs-kubernetes )
#### Using kubectl
##### Option 1 - OIDC Authenticator
The first option is to use the `oidc` authenticator. This authenticator takes your `id_token` , `refresh_token` and your OIDC `client_secret` and will refresh your token automatically. Once you have authenticated to your identity provider:
```bash
kubectl config set-credentials USER_NAME \
2017-03-27 15:57:11 +00:00
--auth-provider=oidc \
2017-01-16 13:12:43 +00:00
--auth-provider-arg=idp-issuer-url=( issuer url ) \
--auth-provider-arg=client-id=( your client id ) \
--auth-provider-arg=client-secret=( your client secret ) \
--auth-provider-arg=refresh-token=( your refresh token ) \
--auth-provider-arg=idp-certificate-authority=( path to your ca certificate ) \
2017-03-27 15:57:11 +00:00
--auth-provider-arg=id-token=( your id_token ) \
--auth-provider-arg=extra-scopes=( comma separated list of scopes to add to "openid email profile", optional )
2017-01-16 13:12:43 +00:00
```
As an example, running the below command after authenticating to your identity provider:
```bash
kubectl config set-credentials mmosley \
--auth-provider=oidc \
--auth-provider-arg=idp-issuer-url=https://oidcidp.tremolo.lan:8443/auth/idp/OidcIdP \
--auth-provider-arg=client-id=kubernetes \
--auth-provider-arg=client-secret=1db158f6-177d-4d9c-8a8b-d36869918ec5 \
--auth-provider-arg=refresh-token=q1bKLFOyUiosTfawzA93TzZIDzH2TNa2SMm0zEiPKTUwME6BkEo6Sql5yUWVBSWpKUGphaWpxSVAfekBOZbBhaEW+VlFUeVRGcluyVF5JT4+haZmPsluFoFu5XkpXk5BXqHega4GAXlF+ma+vmYpFcHe5eZR+slBFpZKtQA= \
--auth-provider-arg=idp-certificate-authority=/root/ca.pem \
2017-03-27 15:57:11 +00:00
--auth-provider-arg=extra-scopes=groups \
2017-01-16 13:12:43 +00:00
--auth-provider-arg=id-token=eyJraWQiOiJDTj1vaWRjaWRwLnRyZW1vbG8ubGFuLCBPVT1EZW1vLCBPPVRybWVvbG8gU2VjdXJpdHksIEw9QXJsaW5ndG9uLCBTVD1WaXJnaW5pYSwgQz1VUy1DTj1rdWJlLWNhLTEyMDIxNDc5MjEwMzYwNzMyMTUyIiwiYWxnIjoiUlMyNTYifQ.eyJpc3MiOiJodHRwczovL29pZGNpZHAudHJlbW9sby5sYW46ODQ0My9hdXRoL2lkcC9PaWRjSWRQIiwiYXVkIjoia3ViZXJuZXRlcyIsImV4cCI6MTQ4MzU0OTUxMSwianRpIjoiMm96US15TXdFcHV4WDlHZUhQdy1hZyIsImlhdCI6MTQ4MzU0OTQ1MSwibmJmIjoxNDgzNTQ5MzMxLCJzdWIiOiI0YWViMzdiYS1iNjQ1LTQ4ZmQtYWIzMC0xYTAxZWU0MWUyMTgifQ.w6p4J_6qQ1HzTG9nrEOrubxIMb9K5hzcMPxc9IxPx2K4xO9l-oFiUw93daH3m5pluP6K7eOE6txBuRVfEcpJSwlelsOsW8gb8VJcnzMS9EnZpeA0tW_p-mnkFc3VcfyXuhe5R3G7aa5d8uHv70yJ9Y3-UhjiN9EhpMdfPAoEB9fYKKkJRzF7utTTIPGrSaSU6d2pcpfYKaxIwePzEkT4DfcQthoZdy9ucNvvLoi1DIC-UocFD8HLs8LYKEqSxQvOcvnThbObJ9af71EwmuE21fO5KzMW20KtAeget1gnldOosPtz1G5EwvaQ401-RPQzPGMVBld0_zMCAwZttJ4knw
```
Which would produce the below configuration:
```yaml
users:
- name: mmosley
user:
auth-provider:
config:
client-id: kubernetes
client-secret: 1db158f6-177d-4d9c-8a8b-d36869918ec5
2017-03-27 15:57:11 +00:00
extra-scopes: groups
2017-01-16 13:12:43 +00:00
id-token: eyJraWQiOiJDTj1vaWRjaWRwLnRyZW1vbG8ubGFuLCBPVT1EZW1vLCBPPVRybWVvbG8gU2VjdXJpdHksIEw9QXJsaW5ndG9uLCBTVD1WaXJnaW5pYSwgQz1VUy1DTj1rdWJlLWNhLTEyMDIxNDc5MjEwMzYwNzMyMTUyIiwiYWxnIjoiUlMyNTYifQ.eyJpc3MiOiJodHRwczovL29pZGNpZHAudHJlbW9sby5sYW46ODQ0My9hdXRoL2lkcC9PaWRjSWRQIiwiYXVkIjoia3ViZXJuZXRlcyIsImV4cCI6MTQ4MzU0OTUxMSwianRpIjoiMm96US15TXdFcHV4WDlHZUhQdy1hZyIsImlhdCI6MTQ4MzU0OTQ1MSwibmJmIjoxNDgzNTQ5MzMxLCJzdWIiOiI0YWViMzdiYS1iNjQ1LTQ4ZmQtYWIzMC0xYTAxZWU0MWUyMTgifQ.w6p4J_6qQ1HzTG9nrEOrubxIMb9K5hzcMPxc9IxPx2K4xO9l-oFiUw93daH3m5pluP6K7eOE6txBuRVfEcpJSwlelsOsW8gb8VJcnzMS9EnZpeA0tW_p-mnkFc3VcfyXuhe5R3G7aa5d8uHv70yJ9Y3-UhjiN9EhpMdfPAoEB9fYKKkJRzF7utTTIPGrSaSU6d2pcpfYKaxIwePzEkT4DfcQthoZdy9ucNvvLoi1DIC-UocFD8HLs8LYKEqSxQvOcvnThbObJ9af71EwmuE21fO5KzMW20KtAeget1gnldOosPtz1G5EwvaQ401-RPQzPGMVBld0_zMCAwZttJ4knw
idp-certificate-authority: /root/ca.pem
idp-issuer-url: https://oidcidp.tremolo.lan:8443/auth/idp/OidcIdP
refresh-token: q1bKLFOyUiosTfawzA93TzZIDzH2TNa2SMm0zEiPKTUwME6BkEo6Sql5yUWVBSWpKUGphaWpxSVAfekBOZbBhaEW+VlFUeVRGcluyVF5JT4+haZmPsluFoFu5XkpXk5BXq
name: oidc
```
Once your `id_token` expires, `kubectl` will attempt to refresh your `id_token` using your `refresh_token` and `client_secret` storing the new values for the `refresh_token` and `id_token` in your `kube/.config` .
##### Option 2 - Use the `--token` Option
The `kubectl` command lets you pass in a token using the `--token` option. Simply copy and paste the `id_token` into this option:
```
kubectl --token=eyJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJodHRwczovL21sYi50cmVtb2xvLmxhbjo4MDQzL2F1dGgvaWRwL29pZGMiLCJhdWQiOiJrdWJlcm5ldGVzIiwiZXhwIjoxNDc0NTk2NjY5LCJqdGkiOiI2RDUzNXoxUEpFNjJOR3QxaWVyYm9RIiwiaWF0IjoxNDc0NTk2MzY5LCJuYmYiOjE0NzQ1OTYyNDksInN1YiI6Im13aW5kdSIsInVzZXJfcm9sZSI6WyJ1c2VycyIsIm5ldy1uYW1lc3BhY2Utdmlld2VyIl0sImVtYWlsIjoibXdpbmR1QG5vbW9yZWplZGkuY29tIn0.f2As579n9VNoaKzoF-dOQGmXkFKf1FMyNV0-va_B63jn-_n9LGSCca_6IVMP8pO-Zb4KvRqGyTP0r3HkHxYy5c81AnIh8ijarruczl-TK_yF5akjSTHFZD-0gRzlevBDiH8Q79NAr-ky0P4iIXS8lY9Vnjch5MF74Zx0c3alKJHJUnnpjIACByfF2SCaYzbWFMUNat-K1PaUk5-ujMBG7yYnr95xD-63n8CO8teGUAAEMx6zRjzfhnhbzX-ajwZLGwGUBT4WqjMs70-6a7_8gZmLZb2az1cZynkFRj2BaCkVT3A2RrjeEwZEtGXlMqKJ1_I2ulrOVsYx01_yD35-rw get nodes
```
2016-08-25 16:30:56 +00:00
2016-08-03 22:03:58 +00:00
### Webhook Token Authentication
Webhook authentication is a hook for verifying bearer tokens.
* `--authentication-token-webhook-config-file` a kubeconfig file describing how to access the remote webhook service.
* `--authentication-token-webhook-cache-ttl` how long to cache authentication decisions. Defaults to two minutes.
2017-03-16 22:42:11 +00:00
The configuration file uses the [kubeconfig ](/docs/concepts/cluster-administration/authenticate-across-clusters-kubeconfig/ )
2016-08-03 22:03:58 +00:00
file format. Within the file "users" refers to the API server webhook and
"clusters" refers to the remote service. An example would be:
```yaml
# clusters refers to the remote service.
clusters:
- name: name-of-remote-authn-service
cluster:
certificate-authority: /path/to/ca.pem # CA for verifying the remote service.
server: https://authn.example.com/authenticate # URL of remote service to query. Must use 'https'.
# users refers to the API server's webhook configuration.
users:
- name: name-of-api-server
user:
client-certificate: /path/to/cert.pem # cert for the webhook plugin to use
client-key: /path/to/key.pem # key matching the cert
# kubeconfig files require a context. Provide one for the API server.
current-context: webhook
contexts:
- context:
cluster: name-of-remote-authn-service
user: name-of-api-sever
name: webhook
```
2016-09-25 22:55:49 +00:00
When a client attempts to authenticate with the API server using a bearer token
as discussed [above ](#putting-a-bearer-token-in-a-request ),
the authentication webhook
2016-08-03 22:03:58 +00:00
queries the remote service with a review object containing the token. Kubernetes
2016-09-25 22:55:49 +00:00
will not challenge a request that lacks such a header.
2016-08-03 22:03:58 +00:00
2017-09-23 22:51:02 +00:00
Note that webhook API objects are subject to the same [versioning compatibility rules ](/docs/concepts/overview/kubernetes-api/ )
2016-08-03 22:03:58 +00:00
as other Kubernetes API objects. Implementers should be aware of looser
compatibility promises for beta objects and check the "apiVersion" field of the
request to ensure correct deserialization. Additionally, the API server must
enable the `authentication.k8s.io/v1beta1` API extensions group (`--runtime-config=authentication.k8s.io/v1beta1=true`).
The request body will be of the following format:
```json
{
"apiVersion": "authentication.k8s.io/v1beta1",
"kind": "TokenReview",
"spec": {
"token": "(BEARERTOKEN)"
}
}
```
2017-08-01 06:53:04 +00:00
The remote service is expected to fill the `status` field of
the request to indicate the success of the login. The response body's `spec`
2016-08-03 22:03:58 +00:00
field is ignored and may be omitted. A successful validation of the bearer
token would return:
```json
{
"apiVersion": "authentication.k8s.io/v1beta1",
"kind": "TokenReview",
"status": {
"authenticated": true,
"user": {
"username": "janedoe@example.com",
"uid": "42",
"groups": [
"developers",
"qa"
],
"extra": {
"extrafield1": [
"extravalue1",
"extravalue2"
]
}
}
}
}
```
An unsuccessful request would return:
```json
{
"apiVersion": "authentication.k8s.io/v1beta1",
"kind": "TokenReview",
"status": {
"authenticated": false
}
}
```
HTTP status codes can be used to supply additional error context.
2016-11-01 12:42:59 +00:00
### Authenticating Proxy
The API server can be configured to identify users from request header values, such as `X-Remote-User` .
It is designed for use in combination with an authenticating proxy, which sets the request header value.
2017-03-11 05:48:21 +00:00
* `--requestheader-username-headers` Required, case-insensitive. Header names to check, in order, for the user identity. The first header containing a value is used as the username.
* `--requestheader-group-headers` 1.6+. Optional, case-insensitive. "X-Remote-Group" is suggested. Header names to check, in order, for the user's groups. All values in all specified headers are used as group names.
* `--requestheader-extra-headers-prefix` 1.6+. Optional, case-insensitive. "X-Remote-Extra-" is suggested. Header prefixes to look for to determine extra information about the user (typically used by the configured authorization plugin). Any headers beginning with any of the specified prefixes have the prefix removed, the remainder of the header name becomes the extra key, and the header value is the extra value.
For example, with this configuration:
```
--requestheader-username-headers=X-Remote-User
--requestheader-group-headers=X-Remote-Group
--requestheader-extra-headers-prefix=X-Remote-Extra-
```
this request:
```
GET / HTTP/1.1
X-Remote-User: fido
X-Remote-Group: dogs
X-Remote-Group: dachshunds
X-Remote-Extra-Scopes: openid
X-Remote-Extra-Scopes: profile
```
would result in this user info:
```yaml
name: fido
groups:
- dogs
- dachshunds
extra:
scopes:
- openid
- profile
```
2016-11-01 12:42:59 +00:00
In order to prevent header spoofing, the authenticating proxy is required to present a valid client
2017-01-16 13:12:43 +00:00
certificate to the API server for validation against the specified CA before the request headers are
2016-11-01 12:42:59 +00:00
checked.
* `--requestheader-client-ca-file` Required. PEM-encoded certificate bundle. A valid client certificate must be presented and validated against the certificate authorities in the specified file before the request headers are checked for user names.
2017-01-16 13:12:43 +00:00
* `--requestheader-allowed-names` Optional. List of common names (cn). If set, a valid client certificate with a Common Name (cn) in the specified list must be presented before the request headers are checked for user names. If empty, any Common Name is allowed.
2016-11-01 12:42:59 +00:00
2016-08-03 22:03:58 +00:00
### Keystone Password
Keystone authentication is enabled by passing the `--experimental-keystone-url=<AuthURL>`
option to the API server during startup. The plugin is implemented in
`plugin/pkg/auth/authenticator/password/keystone/keystone.go` and currently uses
2017-09-10 21:38:49 +00:00
basic auth to verify user by username and password.
2016-04-04 18:52:01 +00:00
2016-11-04 05:05:31 +00:00
If you have configured self-signed certificates for the Keystone server,
you may need to set the `--experimental-keystone-ca-file=SOMEFILE` option when
starting the Kubernetes API server. If you set the option, the Keystone
server's certificate is verified by one of the authorities in the
`experimental-keystone-ca-file` . Otherwise, the certificate is verified by
the host's root Certificate Authority.
2016-02-26 11:54:48 +00:00
For details on how to use keystone to manage projects and users, refer to the
2016-08-03 22:03:58 +00:00
[Keystone documentation ](http://docs.openstack.org/developer/keystone/ ). Please
note that this plugin is still experimental, under active development, and likely
to change in subsequent releases.
2016-04-04 18:52:01 +00:00
2016-08-03 22:03:58 +00:00
Please refer to the [discussion ](https://github.com/kubernetes/kubernetes/pull/11798#issuecomment-129655212 ),
[blueprint ](https://github.com/kubernetes/kubernetes/issues/11626 ) and [proposed
changes](https://github.com/kubernetes/kubernetes/pull/25536) for more details.
2016-02-26 11:54:48 +00:00
2016-09-28 21:19:08 +00:00
## Anonymous requests
2017-01-16 13:12:43 +00:00
When enabled, requests that are not rejected by other configured authentication methods are
treated as anonymous requests, and given a username of `system:anonymous` and a group of
2016-09-28 21:19:08 +00:00
`system:unauthenticated` .
For example, on a server with token authentication configured, and anonymous access enabled,
2017-01-16 13:12:43 +00:00
a request providing an invalid bearer token would receive a `401 Unauthorized` error.
A request providing no bearer token would be treated as an anonymous request.
2016-09-28 21:19:08 +00:00
2017-03-24 18:03:01 +00:00
In 1.5.1-1.5.x, anonymous access is disabled by default, and can be enabled by
2017-03-09 17:54:47 +00:00
passing the `--anonymous-auth=false` option to the API server.
In 1.6+, anonymous access is enabled by default if an authorization mode other than `AlwaysAllow`
is used, and can be disabled by passing the `--anonymous-auth=false` option to the API server.
2017-03-24 18:03:01 +00:00
Starting in 1.6, the ABAC and RBAC authorizers require explicit authorization of the
`system:anonymous` user or the `system:unauthenticated` group, so legacy policy rules
2017-03-09 17:54:47 +00:00
that grant access to the `*` user or `*` group do not include anonymous users.
2016-09-28 21:19:08 +00:00
2017-04-04 23:00:55 +00:00
## User impersonation
A user can act as another user through impersonation headers. These let requests
manually override the user info a request authenticates as. For example, an admin
could use this feature to debug an authorization policy by temporarily
impersonating another user and seeing if a request was denied.
Impersonation requests first authenticate as the requesting user, then switch
to the impersonated user info.
* A user makes an API call with their credentials _and_ impersonation headers.
* API server authenticates the user.
* API server ensures the authenticated users has impersonation privileges.
* Request user info is replaced with impersonation values.
* Request is evaluated, authorization acts on impersonated user info.
The following HTTP headers can be used to performing an impersonation request:
* `Impersonate-User` : The username to act as.
* `Impersonate-Group` : A group name to act as. Can be provided multiple times to set multiple groups. Optional. Requires "Impersonate-User"
* `Impersonate-Extra-( extra name )` : A dynamic header used to associate extra fields with the user. Optional. Requires "Impersonate-User"
An example set of headers:
```http
Impersonate-User: jane.doe@example.com
Impersonate-Group: developers
Impersonate-Group: admins
Impersonate-Extra-dn: cn=jane,ou=engineers,dc=example,dc=com
Impersonate-Extra-scopes: view
Impersonate-Extra-scopes: development
```
When using `kubectl` set the `--as` flag to configure the `Impersonate-User`
2017-06-29 07:51:40 +00:00
header, set the `--as-group` flag to configure the `Impersonate-Group` header.
2017-04-04 23:00:55 +00:00
```shell
$ kubectl drain mynode
Error from server (Forbidden): User "clark" cannot get nodes at the cluster scope. (get nodes mynode)
2017-06-29 07:51:40 +00:00
$ kubectl drain mynode --as=superman --as-group=system:masters
2017-04-04 23:00:55 +00:00
node "mynode" cordoned
node "mynode" drained
```
To impersonate a user, group, or set extra fields, the impersonating user must
have the ability to perform the "impersonate" verb on the kind of attribute
being impersonated ("user", "group", etc.). For clusters that enable the RBAC
authorization plugin, the following ClusterRole encompasses the rules needed to
set user and group impersonation headers:
```yaml
Release 1.8 (#5659)
* GC now supports non-core resources
* Add two examples about how to analysis audits of kube-apiserver (#4264)
* Deprecate system:nodes binding
* [1.8] StatefulSet `initialized` annotation is now ignored.
* inits the kubeadm upgrade docs
addresses kubernetes/kubernetes.github.io/issues/4689
* adds kubeadm upgrade cmd to ToC
addresses kubernetes/kubernetes.github.io/issues/4689
* add workload placement docs
* ScaleIO - document udpate for 1.8
* Add documentation on storageClass.mountOptions and PV.mountOptions (#5254)
* Add documentation on storageClass.mountOptions and PV.mountOptions
* convert notes into callouts
* Add docs for CustomResource validation
add info about supported fields
* advanced audit beta features (#5300)
* Update job workload doc with backoff failure policy (#5319)
Add to the Jobs documentation how to use the new backoffLimit field that
limit the number of Pod failure before considering the Job as failed.
* Documented additional AWS Service annotations (#4864)
* Add device plugin doc under concepts/cluster-administration. (#5261)
* Add device plugin doc under concepts/cluster-administration.
* Update device-plugins.md
* Update device-plugins.md
Add meta description. Fix typo. Change bare metal deployment to manual deployment.
* Update device-plugins.md
Fix typo again.
* Update page.version. (#5341)
* Add documentation on storageClass.reclaimPolicy (#5171)
* [Advanced audit] use new herf for audit-api (#5349)
This tag contains all the changes in v1beta1 version. Update it now.
* Added documentation around creating the InitializerConfiguration for the persistent volume label controller in the cloud-controller-manager (#5255)
* Documentation for kubectl plugins (#5294)
* Documentation for kubectl plugins
* Update kubectl-plugins.md
* Update kubectl-plugins.md
* Updated CPU manager docs to match implementation. (#5332)
* Noted limitation of alpha static cpumanager.
* Updated CPU manager docs to match implementation.
- Removed references to CPU pressure node condition and evictions.
- Added note about new --cpu-manager-reconcile-period flag.
- Added note about node allocatable requirements for static policy.
- Noted limitation of alpha static cpumanager.
* Move cpu-manager task link to rsc mgmt section.
* init containers annotation removed in 1.8 (#5390)
* Add documentation for TaintNodesByCondition (#5352)
* Add documentation for TaintNodesByCondition
* Update nodes.md
* Update taint-and-toleration.md
* Update daemonset.md
* Update nodes.md
* Update taint-and-toleration.md
* Update daemonset.md
* Fix deployments (#5421)
* Document extended resources and OIR deprecation. (#5399)
* Document extended resources and OIR deprecation.
* Updated extended resources doc per reviews.
* reverts extra spacing in _data/tasks.yml
* addresses `kubeadm upgrade` review comments
Feedback from @chenopis, @luxas, and @steveperry-53 addressed with this commit
* HugePages documentation (#5419)
* Update cpu-management-policies.md (#5407)
Fixed the bad link.
Modified "cpu" to "CPU".
Added more 'yaml' as supplement.
* Update RBAC docs for v1 (#5445)
* Add user docs for pod priority and preemption (#5328)
* Add user docs for pod priority and preemption
* Update pod-priority-preemption.md
* More updates
* Update docs/admin/kubeadm.md for 1.8 (#5440)
- Made a couple of minor wording changes (not strictly 1.8 related).
- Did some reformatting (not strictly 1.8 related).
- Updated references to the default token TTL (was infinite, now 24 hours).
- Documented the new `--discovery-token-ca-cert-hash` and `--discovery-token-unsafe-skip-ca-verification` flags for `kubeadm join`.
- Added references to the new `--discovery-token-ca-cert-hash` flag in all the default examples.
- Added a new _Security model_ section that describes the security tradeoffs of the various discovery modes.
- Documented the new `--groups` flag for `kubeadm token create`.
- Added a note of caution under _Automating kubeadm_ that references the _Security model_ section.
- Updated the component version table to drop 1.6 and add 1.8.
- Update `_data/reference.yml` to try to get the sidebar fixed up and more consistent with `kubefed`.
* Update StatefulSet Basics for 1.8 release (#5398)
* addresses `kubeadm upgrade` review comments
2nd iteration review comments by @luxas
* adds kubelet upgrade section to kubeadm upgrade
* Fix a bulleted list on docs/admin/kubeadm.md. (#5458)
I updated this doc yesterday and I was absolutely sure I fixed this, but I just saw that this commit got lost somehow.
This was introduced recently in https://github.com/kubernetes/kubernetes.github.io/pull/5440.
* Clarify the API to check for device plugins
* Moving Flexvolume to separate out-of-tree section
* addresses `kubeadm upgrade` review comments
CC: @luxas
* fixes kubeadm upgrade index
* Update Stackdriver Logging documentation (#5495)
* Re-update WordPress and MySQL PV doc to use apps/v1beta2 APIs (#5526)
* Update statefulset concepts doc to use apps/v1beta2 APIs (#5420)
* add document on kubectl's behavior regarding initializers (#5505)
* Update docs/admin/kubeadm.md to cover self-hosting in 1.8. (#5497)
This is a new beta feature in 1.8.
* Update kubectl patch doc to use apps/v1beta2 APIs (#5422)
* [1.8] Update "Run Applications" tasks to apps/v1beta2. (#5525)
* Update replicated stateful application task for 1.8.
* Update single instance stateful app task for 1.8.
* Update stateless app task for 1.8.
* Update kubectl patch task for 1.8.
* fix the link of persistent storage (#5515)
* update the admission-controllers.md index.md what-is-kubernetes.md link
* fix the link of persistent storage
* Add quota support for local ephemeral storage (#5493)
* Add quota support for local ephemeral storage
update the doc to this alpha feature
* Update resource-quotas.md
* Updated Deployments concepts doc (#5491)
* Updated Deployments concepts doc
* Addressed comments
* Addressed more comments
* Modify allocatable storage to ephemeral-storage (#5490)
Update the doc to use ephemeral-storage instead of storage
* Revamped concepts doc for ReplicaSet (#5463)
* Revamped concepts doc for ReplicaSet
* Minor changes to call out specific versions for selector defaulting and
immutability
* Addressed doc review comments
* Remove petset documentations (#5395)
* Update docs to use batch/v1beta1 cronjobs (#5475)
* add federation job doc (#5485)
* add federation job doc
* Update job.md
Edits for clarity and consistency
* Update job.md
Fixed a typo
* update DaemonSet concept for 1.8 release (#5397)
* update DaemonSet concept for 1.8 release
* Update daemonset.md
Fix typo. than -> then
* Update bootstrap tokens doc for 1.8. (#5479)
* Update bootstrap tokens doc for 1.8.
This has some changes I missed when I was updating the main kubeadm documention:
- Bootstrap tokens are now beta, not alpha (https://github.com/kubernetes/features/issues/130)
- The apiserver flag to enable the authenticator changedin 1.8 (https://github.com/kubernetes/kubernetes/pull/51198)
- Added `auth-extra-groups` documentaion (https://github.com/kubernetes/kubernetes/pull/50933)
- Updated the _Token Management with `kubeadm`_ section to link to the main kubeadm docs, since it was just duplicated information.
* Update bootstrap-tokens.md
* Updated the Cassandra tutorial to use apps/v1beta2 (#5548)
* add docs for AllowPrivilegeEscalation (#5448)
Signed-off-by: Jess Frazelle <acidburn@microsoft.com>
* Add local ephemeral storage alpha feature in managing compute resource (#5522)
* Add local ephemeral storage alpha feature in managing compute resource
Since 1.8, we add the local ephemeral storage alpha feature as one
resource type to manage. Add this feature into the doc.
* Update manage-compute-resources-container.md
* Update manage-compute-resources-container.md
* Update manage-compute-resources-container.md
* Update manage-compute-resources-container.md
* Update manage-compute-resources-container.md
* Update manage-compute-resources-container.md
* Added documentation for Metrics Server (#5560)
* authorization: improve authorization debugging docs (#5549)
* Document mount propagation (#5544)
* Update /docs/setup/independent/create-cluster-kubeadm.md for 1.8. (#5524)
This introduction needed a couple of small tweaks to cover the `--discovery-token-ca-cert-hash` flag added in https://github.com/kubernetes/kubernetes/pull/49520 and some version bumps.
* Add task doc for alpha dynamic kubelet configuration (#5523)
* Fix input/output of selfsubjectaccess review (#5593)
* Add docs for implementing resize (#5528)
* Add docs for implementing resize
* Update admission-controllers.md
* Added link to PVC section
* minor typo fixes
* Update NetworkPolicy concept guide with egress and CIDR changes (#5529)
* update zookeeper tutorial for 1.8 release
* add doc for hostpath type (#5503)
* Federated Hpa feature doc (#5487)
* Federated Hpa feature doc
* Federated Hpa feature doc review fixes
* Update hpa.md
* Update hpa.md
* update cloud controller manager docs for v1.8
* Update cronjob with defaults information (#5556)
* Kubernetes 1.8 reference docs (#5632)
* Kubernetes 1.8 reference docs
* Kubectl reference docs for 1.8
* Update side bar with 1.8 kubectl and api ref docs links
* remove petset.md
* update on state of HostAlias in 1.8 with hostNetwork Pod support (#5644)
* Fix cron job deletion section (#5655)
* update imported docs (#5656)
* Add documentation for certificate rotation. (#5639)
* Link to using kubeadm page
* fix the command output
fix the command output
* fix typo in api/resources reference: "Worloads"
* Add documentation for certificate rotation.
* Create TOC entry for cloud controller manager. (#5662)
* Updates for new versions of API types
* Followup 5655: fix link to garbage collection (#5666)
* Temporarily redirect resources-reference to api-reference. (#5668)
* Update config for 1.8 release. (#5661)
* Update config for 1.8 release.
* Address reviewer comments.
* Switch references in HPA docs from alpha to beta (#5671)
The HPA docs still referenced the alpha version. This switches them to
talk about v2beta1, which is the appropriate version for Kubernetes 1.8
* Deprecate openstack heat (#5670)
* Fix typo in pod preset conflict example
Move container port definition to the correct line.
* Highlight openstack-heat provider deprecation
The openstack-heat provider for kube-up is being deprecated and will be
removed in a future release.
* Temporarily fix broken links by redirecting. (#5672)
* Fix broken links. (#5675)
* Fix render of code block (#5674)
* Fix broken links. (#5677)
* Add a small note about auto-bootstrapped CSR ClusterRoles (#5660)
* Update kubeadm install doc for v1.8 (#5676)
* add draft workloads api content for 1.8 (#5650)
* add draft workloads api content for 1.8
* edits per review, add tables, for 1.8 workloads api doc
* fix typo
* Minor fixes to kubeadm 1.8 upgrade guide. (#5678)
- The kubelet upgrade instructions should be done on every host, not
just worker nodes.
- We should just upgrade all packages, instead of calling out kubelet
specifically. This will also upgrade kubectl, kubeadm, and
kubernetes-cni, if installed.
- Draining nodes should also ignore daemonsets, and master errors can be
ignored.
- Make sure that the new kubeadm download is chmoded correctly.
- Add a step to run `kubeadm version` to verify after downloading.
- Manually approve new kubelet CSRs if rotation is enabled (known issue).
* Release 1.8 (#5680)
* Fix versions for 1.8 API ref docs
* Updates for 1.8 kubectl reference docs
* Kubeadm /docs/admin/kubeadm.md cleanup, editing. (#5681)
* Update docs/admin/kubeadm.md (mostly 1.8 related).
This is Fabrizio's work, which I'm committing along with my edits (in a commit on top of this).
* A few of my own edits to clarify and clean up some Markdown.
2017-09-29 04:46:51 +00:00
apiVersion: rbac.authorization.k8s.io/v1
2017-04-04 23:00:55 +00:00
kind: ClusterRole
metadata:
name: impersonator
rules:
- apiGroups: [""]
resources: ["users", "groups", "serviceaccounts"]
verbs: ["impersonate"]
```
Extra fields are evaluated as sub-resources of the resource "userextras". To
allow a user to use impersonation headers for the extra field "scopes," a user
should be granted the following role:
```yaml
Release 1.8 (#5659)
* GC now supports non-core resources
* Add two examples about how to analysis audits of kube-apiserver (#4264)
* Deprecate system:nodes binding
* [1.8] StatefulSet `initialized` annotation is now ignored.
* inits the kubeadm upgrade docs
addresses kubernetes/kubernetes.github.io/issues/4689
* adds kubeadm upgrade cmd to ToC
addresses kubernetes/kubernetes.github.io/issues/4689
* add workload placement docs
* ScaleIO - document udpate for 1.8
* Add documentation on storageClass.mountOptions and PV.mountOptions (#5254)
* Add documentation on storageClass.mountOptions and PV.mountOptions
* convert notes into callouts
* Add docs for CustomResource validation
add info about supported fields
* advanced audit beta features (#5300)
* Update job workload doc with backoff failure policy (#5319)
Add to the Jobs documentation how to use the new backoffLimit field that
limit the number of Pod failure before considering the Job as failed.
* Documented additional AWS Service annotations (#4864)
* Add device plugin doc under concepts/cluster-administration. (#5261)
* Add device plugin doc under concepts/cluster-administration.
* Update device-plugins.md
* Update device-plugins.md
Add meta description. Fix typo. Change bare metal deployment to manual deployment.
* Update device-plugins.md
Fix typo again.
* Update page.version. (#5341)
* Add documentation on storageClass.reclaimPolicy (#5171)
* [Advanced audit] use new herf for audit-api (#5349)
This tag contains all the changes in v1beta1 version. Update it now.
* Added documentation around creating the InitializerConfiguration for the persistent volume label controller in the cloud-controller-manager (#5255)
* Documentation for kubectl plugins (#5294)
* Documentation for kubectl plugins
* Update kubectl-plugins.md
* Update kubectl-plugins.md
* Updated CPU manager docs to match implementation. (#5332)
* Noted limitation of alpha static cpumanager.
* Updated CPU manager docs to match implementation.
- Removed references to CPU pressure node condition and evictions.
- Added note about new --cpu-manager-reconcile-period flag.
- Added note about node allocatable requirements for static policy.
- Noted limitation of alpha static cpumanager.
* Move cpu-manager task link to rsc mgmt section.
* init containers annotation removed in 1.8 (#5390)
* Add documentation for TaintNodesByCondition (#5352)
* Add documentation for TaintNodesByCondition
* Update nodes.md
* Update taint-and-toleration.md
* Update daemonset.md
* Update nodes.md
* Update taint-and-toleration.md
* Update daemonset.md
* Fix deployments (#5421)
* Document extended resources and OIR deprecation. (#5399)
* Document extended resources and OIR deprecation.
* Updated extended resources doc per reviews.
* reverts extra spacing in _data/tasks.yml
* addresses `kubeadm upgrade` review comments
Feedback from @chenopis, @luxas, and @steveperry-53 addressed with this commit
* HugePages documentation (#5419)
* Update cpu-management-policies.md (#5407)
Fixed the bad link.
Modified "cpu" to "CPU".
Added more 'yaml' as supplement.
* Update RBAC docs for v1 (#5445)
* Add user docs for pod priority and preemption (#5328)
* Add user docs for pod priority and preemption
* Update pod-priority-preemption.md
* More updates
* Update docs/admin/kubeadm.md for 1.8 (#5440)
- Made a couple of minor wording changes (not strictly 1.8 related).
- Did some reformatting (not strictly 1.8 related).
- Updated references to the default token TTL (was infinite, now 24 hours).
- Documented the new `--discovery-token-ca-cert-hash` and `--discovery-token-unsafe-skip-ca-verification` flags for `kubeadm join`.
- Added references to the new `--discovery-token-ca-cert-hash` flag in all the default examples.
- Added a new _Security model_ section that describes the security tradeoffs of the various discovery modes.
- Documented the new `--groups` flag for `kubeadm token create`.
- Added a note of caution under _Automating kubeadm_ that references the _Security model_ section.
- Updated the component version table to drop 1.6 and add 1.8.
- Update `_data/reference.yml` to try to get the sidebar fixed up and more consistent with `kubefed`.
* Update StatefulSet Basics for 1.8 release (#5398)
* addresses `kubeadm upgrade` review comments
2nd iteration review comments by @luxas
* adds kubelet upgrade section to kubeadm upgrade
* Fix a bulleted list on docs/admin/kubeadm.md. (#5458)
I updated this doc yesterday and I was absolutely sure I fixed this, but I just saw that this commit got lost somehow.
This was introduced recently in https://github.com/kubernetes/kubernetes.github.io/pull/5440.
* Clarify the API to check for device plugins
* Moving Flexvolume to separate out-of-tree section
* addresses `kubeadm upgrade` review comments
CC: @luxas
* fixes kubeadm upgrade index
* Update Stackdriver Logging documentation (#5495)
* Re-update WordPress and MySQL PV doc to use apps/v1beta2 APIs (#5526)
* Update statefulset concepts doc to use apps/v1beta2 APIs (#5420)
* add document on kubectl's behavior regarding initializers (#5505)
* Update docs/admin/kubeadm.md to cover self-hosting in 1.8. (#5497)
This is a new beta feature in 1.8.
* Update kubectl patch doc to use apps/v1beta2 APIs (#5422)
* [1.8] Update "Run Applications" tasks to apps/v1beta2. (#5525)
* Update replicated stateful application task for 1.8.
* Update single instance stateful app task for 1.8.
* Update stateless app task for 1.8.
* Update kubectl patch task for 1.8.
* fix the link of persistent storage (#5515)
* update the admission-controllers.md index.md what-is-kubernetes.md link
* fix the link of persistent storage
* Add quota support for local ephemeral storage (#5493)
* Add quota support for local ephemeral storage
update the doc to this alpha feature
* Update resource-quotas.md
* Updated Deployments concepts doc (#5491)
* Updated Deployments concepts doc
* Addressed comments
* Addressed more comments
* Modify allocatable storage to ephemeral-storage (#5490)
Update the doc to use ephemeral-storage instead of storage
* Revamped concepts doc for ReplicaSet (#5463)
* Revamped concepts doc for ReplicaSet
* Minor changes to call out specific versions for selector defaulting and
immutability
* Addressed doc review comments
* Remove petset documentations (#5395)
* Update docs to use batch/v1beta1 cronjobs (#5475)
* add federation job doc (#5485)
* add federation job doc
* Update job.md
Edits for clarity and consistency
* Update job.md
Fixed a typo
* update DaemonSet concept for 1.8 release (#5397)
* update DaemonSet concept for 1.8 release
* Update daemonset.md
Fix typo. than -> then
* Update bootstrap tokens doc for 1.8. (#5479)
* Update bootstrap tokens doc for 1.8.
This has some changes I missed when I was updating the main kubeadm documention:
- Bootstrap tokens are now beta, not alpha (https://github.com/kubernetes/features/issues/130)
- The apiserver flag to enable the authenticator changedin 1.8 (https://github.com/kubernetes/kubernetes/pull/51198)
- Added `auth-extra-groups` documentaion (https://github.com/kubernetes/kubernetes/pull/50933)
- Updated the _Token Management with `kubeadm`_ section to link to the main kubeadm docs, since it was just duplicated information.
* Update bootstrap-tokens.md
* Updated the Cassandra tutorial to use apps/v1beta2 (#5548)
* add docs for AllowPrivilegeEscalation (#5448)
Signed-off-by: Jess Frazelle <acidburn@microsoft.com>
* Add local ephemeral storage alpha feature in managing compute resource (#5522)
* Add local ephemeral storage alpha feature in managing compute resource
Since 1.8, we add the local ephemeral storage alpha feature as one
resource type to manage. Add this feature into the doc.
* Update manage-compute-resources-container.md
* Update manage-compute-resources-container.md
* Update manage-compute-resources-container.md
* Update manage-compute-resources-container.md
* Update manage-compute-resources-container.md
* Update manage-compute-resources-container.md
* Added documentation for Metrics Server (#5560)
* authorization: improve authorization debugging docs (#5549)
* Document mount propagation (#5544)
* Update /docs/setup/independent/create-cluster-kubeadm.md for 1.8. (#5524)
This introduction needed a couple of small tweaks to cover the `--discovery-token-ca-cert-hash` flag added in https://github.com/kubernetes/kubernetes/pull/49520 and some version bumps.
* Add task doc for alpha dynamic kubelet configuration (#5523)
* Fix input/output of selfsubjectaccess review (#5593)
* Add docs for implementing resize (#5528)
* Add docs for implementing resize
* Update admission-controllers.md
* Added link to PVC section
* minor typo fixes
* Update NetworkPolicy concept guide with egress and CIDR changes (#5529)
* update zookeeper tutorial for 1.8 release
* add doc for hostpath type (#5503)
* Federated Hpa feature doc (#5487)
* Federated Hpa feature doc
* Federated Hpa feature doc review fixes
* Update hpa.md
* Update hpa.md
* update cloud controller manager docs for v1.8
* Update cronjob with defaults information (#5556)
* Kubernetes 1.8 reference docs (#5632)
* Kubernetes 1.8 reference docs
* Kubectl reference docs for 1.8
* Update side bar with 1.8 kubectl and api ref docs links
* remove petset.md
* update on state of HostAlias in 1.8 with hostNetwork Pod support (#5644)
* Fix cron job deletion section (#5655)
* update imported docs (#5656)
* Add documentation for certificate rotation. (#5639)
* Link to using kubeadm page
* fix the command output
fix the command output
* fix typo in api/resources reference: "Worloads"
* Add documentation for certificate rotation.
* Create TOC entry for cloud controller manager. (#5662)
* Updates for new versions of API types
* Followup 5655: fix link to garbage collection (#5666)
* Temporarily redirect resources-reference to api-reference. (#5668)
* Update config for 1.8 release. (#5661)
* Update config for 1.8 release.
* Address reviewer comments.
* Switch references in HPA docs from alpha to beta (#5671)
The HPA docs still referenced the alpha version. This switches them to
talk about v2beta1, which is the appropriate version for Kubernetes 1.8
* Deprecate openstack heat (#5670)
* Fix typo in pod preset conflict example
Move container port definition to the correct line.
* Highlight openstack-heat provider deprecation
The openstack-heat provider for kube-up is being deprecated and will be
removed in a future release.
* Temporarily fix broken links by redirecting. (#5672)
* Fix broken links. (#5675)
* Fix render of code block (#5674)
* Fix broken links. (#5677)
* Add a small note about auto-bootstrapped CSR ClusterRoles (#5660)
* Update kubeadm install doc for v1.8 (#5676)
* add draft workloads api content for 1.8 (#5650)
* add draft workloads api content for 1.8
* edits per review, add tables, for 1.8 workloads api doc
* fix typo
* Minor fixes to kubeadm 1.8 upgrade guide. (#5678)
- The kubelet upgrade instructions should be done on every host, not
just worker nodes.
- We should just upgrade all packages, instead of calling out kubelet
specifically. This will also upgrade kubectl, kubeadm, and
kubernetes-cni, if installed.
- Draining nodes should also ignore daemonsets, and master errors can be
ignored.
- Make sure that the new kubeadm download is chmoded correctly.
- Add a step to run `kubeadm version` to verify after downloading.
- Manually approve new kubelet CSRs if rotation is enabled (known issue).
* Release 1.8 (#5680)
* Fix versions for 1.8 API ref docs
* Updates for 1.8 kubectl reference docs
* Kubeadm /docs/admin/kubeadm.md cleanup, editing. (#5681)
* Update docs/admin/kubeadm.md (mostly 1.8 related).
This is Fabrizio's work, which I'm committing along with my edits (in a commit on top of this).
* A few of my own edits to clarify and clean up some Markdown.
2017-09-29 04:46:51 +00:00
apiVersion: rbac.authorization.k8s.io/v1
2017-04-04 23:00:55 +00:00
kind: ClusterRole
metadata:
name: scopes-impersonator
# Can set "Impersonate-Extra-scopes" header.
- apiGroups: ["authentication.k8s.io"]
resources: ["userextras/scopes"]
verbs: ["impersonate"]
```
The values of impersonation headers can also be restricted by limiting the set
of `resourceNames` a resource can take.
```yaml
Release 1.8 (#5659)
* GC now supports non-core resources
* Add two examples about how to analysis audits of kube-apiserver (#4264)
* Deprecate system:nodes binding
* [1.8] StatefulSet `initialized` annotation is now ignored.
* inits the kubeadm upgrade docs
addresses kubernetes/kubernetes.github.io/issues/4689
* adds kubeadm upgrade cmd to ToC
addresses kubernetes/kubernetes.github.io/issues/4689
* add workload placement docs
* ScaleIO - document udpate for 1.8
* Add documentation on storageClass.mountOptions and PV.mountOptions (#5254)
* Add documentation on storageClass.mountOptions and PV.mountOptions
* convert notes into callouts
* Add docs for CustomResource validation
add info about supported fields
* advanced audit beta features (#5300)
* Update job workload doc with backoff failure policy (#5319)
Add to the Jobs documentation how to use the new backoffLimit field that
limit the number of Pod failure before considering the Job as failed.
* Documented additional AWS Service annotations (#4864)
* Add device plugin doc under concepts/cluster-administration. (#5261)
* Add device plugin doc under concepts/cluster-administration.
* Update device-plugins.md
* Update device-plugins.md
Add meta description. Fix typo. Change bare metal deployment to manual deployment.
* Update device-plugins.md
Fix typo again.
* Update page.version. (#5341)
* Add documentation on storageClass.reclaimPolicy (#5171)
* [Advanced audit] use new herf for audit-api (#5349)
This tag contains all the changes in v1beta1 version. Update it now.
* Added documentation around creating the InitializerConfiguration for the persistent volume label controller in the cloud-controller-manager (#5255)
* Documentation for kubectl plugins (#5294)
* Documentation for kubectl plugins
* Update kubectl-plugins.md
* Update kubectl-plugins.md
* Updated CPU manager docs to match implementation. (#5332)
* Noted limitation of alpha static cpumanager.
* Updated CPU manager docs to match implementation.
- Removed references to CPU pressure node condition and evictions.
- Added note about new --cpu-manager-reconcile-period flag.
- Added note about node allocatable requirements for static policy.
- Noted limitation of alpha static cpumanager.
* Move cpu-manager task link to rsc mgmt section.
* init containers annotation removed in 1.8 (#5390)
* Add documentation for TaintNodesByCondition (#5352)
* Add documentation for TaintNodesByCondition
* Update nodes.md
* Update taint-and-toleration.md
* Update daemonset.md
* Update nodes.md
* Update taint-and-toleration.md
* Update daemonset.md
* Fix deployments (#5421)
* Document extended resources and OIR deprecation. (#5399)
* Document extended resources and OIR deprecation.
* Updated extended resources doc per reviews.
* reverts extra spacing in _data/tasks.yml
* addresses `kubeadm upgrade` review comments
Feedback from @chenopis, @luxas, and @steveperry-53 addressed with this commit
* HugePages documentation (#5419)
* Update cpu-management-policies.md (#5407)
Fixed the bad link.
Modified "cpu" to "CPU".
Added more 'yaml' as supplement.
* Update RBAC docs for v1 (#5445)
* Add user docs for pod priority and preemption (#5328)
* Add user docs for pod priority and preemption
* Update pod-priority-preemption.md
* More updates
* Update docs/admin/kubeadm.md for 1.8 (#5440)
- Made a couple of minor wording changes (not strictly 1.8 related).
- Did some reformatting (not strictly 1.8 related).
- Updated references to the default token TTL (was infinite, now 24 hours).
- Documented the new `--discovery-token-ca-cert-hash` and `--discovery-token-unsafe-skip-ca-verification` flags for `kubeadm join`.
- Added references to the new `--discovery-token-ca-cert-hash` flag in all the default examples.
- Added a new _Security model_ section that describes the security tradeoffs of the various discovery modes.
- Documented the new `--groups` flag for `kubeadm token create`.
- Added a note of caution under _Automating kubeadm_ that references the _Security model_ section.
- Updated the component version table to drop 1.6 and add 1.8.
- Update `_data/reference.yml` to try to get the sidebar fixed up and more consistent with `kubefed`.
* Update StatefulSet Basics for 1.8 release (#5398)
* addresses `kubeadm upgrade` review comments
2nd iteration review comments by @luxas
* adds kubelet upgrade section to kubeadm upgrade
* Fix a bulleted list on docs/admin/kubeadm.md. (#5458)
I updated this doc yesterday and I was absolutely sure I fixed this, but I just saw that this commit got lost somehow.
This was introduced recently in https://github.com/kubernetes/kubernetes.github.io/pull/5440.
* Clarify the API to check for device plugins
* Moving Flexvolume to separate out-of-tree section
* addresses `kubeadm upgrade` review comments
CC: @luxas
* fixes kubeadm upgrade index
* Update Stackdriver Logging documentation (#5495)
* Re-update WordPress and MySQL PV doc to use apps/v1beta2 APIs (#5526)
* Update statefulset concepts doc to use apps/v1beta2 APIs (#5420)
* add document on kubectl's behavior regarding initializers (#5505)
* Update docs/admin/kubeadm.md to cover self-hosting in 1.8. (#5497)
This is a new beta feature in 1.8.
* Update kubectl patch doc to use apps/v1beta2 APIs (#5422)
* [1.8] Update "Run Applications" tasks to apps/v1beta2. (#5525)
* Update replicated stateful application task for 1.8.
* Update single instance stateful app task for 1.8.
* Update stateless app task for 1.8.
* Update kubectl patch task for 1.8.
* fix the link of persistent storage (#5515)
* update the admission-controllers.md index.md what-is-kubernetes.md link
* fix the link of persistent storage
* Add quota support for local ephemeral storage (#5493)
* Add quota support for local ephemeral storage
update the doc to this alpha feature
* Update resource-quotas.md
* Updated Deployments concepts doc (#5491)
* Updated Deployments concepts doc
* Addressed comments
* Addressed more comments
* Modify allocatable storage to ephemeral-storage (#5490)
Update the doc to use ephemeral-storage instead of storage
* Revamped concepts doc for ReplicaSet (#5463)
* Revamped concepts doc for ReplicaSet
* Minor changes to call out specific versions for selector defaulting and
immutability
* Addressed doc review comments
* Remove petset documentations (#5395)
* Update docs to use batch/v1beta1 cronjobs (#5475)
* add federation job doc (#5485)
* add federation job doc
* Update job.md
Edits for clarity and consistency
* Update job.md
Fixed a typo
* update DaemonSet concept for 1.8 release (#5397)
* update DaemonSet concept for 1.8 release
* Update daemonset.md
Fix typo. than -> then
* Update bootstrap tokens doc for 1.8. (#5479)
* Update bootstrap tokens doc for 1.8.
This has some changes I missed when I was updating the main kubeadm documention:
- Bootstrap tokens are now beta, not alpha (https://github.com/kubernetes/features/issues/130)
- The apiserver flag to enable the authenticator changedin 1.8 (https://github.com/kubernetes/kubernetes/pull/51198)
- Added `auth-extra-groups` documentaion (https://github.com/kubernetes/kubernetes/pull/50933)
- Updated the _Token Management with `kubeadm`_ section to link to the main kubeadm docs, since it was just duplicated information.
* Update bootstrap-tokens.md
* Updated the Cassandra tutorial to use apps/v1beta2 (#5548)
* add docs for AllowPrivilegeEscalation (#5448)
Signed-off-by: Jess Frazelle <acidburn@microsoft.com>
* Add local ephemeral storage alpha feature in managing compute resource (#5522)
* Add local ephemeral storage alpha feature in managing compute resource
Since 1.8, we add the local ephemeral storage alpha feature as one
resource type to manage. Add this feature into the doc.
* Update manage-compute-resources-container.md
* Update manage-compute-resources-container.md
* Update manage-compute-resources-container.md
* Update manage-compute-resources-container.md
* Update manage-compute-resources-container.md
* Update manage-compute-resources-container.md
* Added documentation for Metrics Server (#5560)
* authorization: improve authorization debugging docs (#5549)
* Document mount propagation (#5544)
* Update /docs/setup/independent/create-cluster-kubeadm.md for 1.8. (#5524)
This introduction needed a couple of small tweaks to cover the `--discovery-token-ca-cert-hash` flag added in https://github.com/kubernetes/kubernetes/pull/49520 and some version bumps.
* Add task doc for alpha dynamic kubelet configuration (#5523)
* Fix input/output of selfsubjectaccess review (#5593)
* Add docs for implementing resize (#5528)
* Add docs for implementing resize
* Update admission-controllers.md
* Added link to PVC section
* minor typo fixes
* Update NetworkPolicy concept guide with egress and CIDR changes (#5529)
* update zookeeper tutorial for 1.8 release
* add doc for hostpath type (#5503)
* Federated Hpa feature doc (#5487)
* Federated Hpa feature doc
* Federated Hpa feature doc review fixes
* Update hpa.md
* Update hpa.md
* update cloud controller manager docs for v1.8
* Update cronjob with defaults information (#5556)
* Kubernetes 1.8 reference docs (#5632)
* Kubernetes 1.8 reference docs
* Kubectl reference docs for 1.8
* Update side bar with 1.8 kubectl and api ref docs links
* remove petset.md
* update on state of HostAlias in 1.8 with hostNetwork Pod support (#5644)
* Fix cron job deletion section (#5655)
* update imported docs (#5656)
* Add documentation for certificate rotation. (#5639)
* Link to using kubeadm page
* fix the command output
fix the command output
* fix typo in api/resources reference: "Worloads"
* Add documentation for certificate rotation.
* Create TOC entry for cloud controller manager. (#5662)
* Updates for new versions of API types
* Followup 5655: fix link to garbage collection (#5666)
* Temporarily redirect resources-reference to api-reference. (#5668)
* Update config for 1.8 release. (#5661)
* Update config for 1.8 release.
* Address reviewer comments.
* Switch references in HPA docs from alpha to beta (#5671)
The HPA docs still referenced the alpha version. This switches them to
talk about v2beta1, which is the appropriate version for Kubernetes 1.8
* Deprecate openstack heat (#5670)
* Fix typo in pod preset conflict example
Move container port definition to the correct line.
* Highlight openstack-heat provider deprecation
The openstack-heat provider for kube-up is being deprecated and will be
removed in a future release.
* Temporarily fix broken links by redirecting. (#5672)
* Fix broken links. (#5675)
* Fix render of code block (#5674)
* Fix broken links. (#5677)
* Add a small note about auto-bootstrapped CSR ClusterRoles (#5660)
* Update kubeadm install doc for v1.8 (#5676)
* add draft workloads api content for 1.8 (#5650)
* add draft workloads api content for 1.8
* edits per review, add tables, for 1.8 workloads api doc
* fix typo
* Minor fixes to kubeadm 1.8 upgrade guide. (#5678)
- The kubelet upgrade instructions should be done on every host, not
just worker nodes.
- We should just upgrade all packages, instead of calling out kubelet
specifically. This will also upgrade kubectl, kubeadm, and
kubernetes-cni, if installed.
- Draining nodes should also ignore daemonsets, and master errors can be
ignored.
- Make sure that the new kubeadm download is chmoded correctly.
- Add a step to run `kubeadm version` to verify after downloading.
- Manually approve new kubelet CSRs if rotation is enabled (known issue).
* Release 1.8 (#5680)
* Fix versions for 1.8 API ref docs
* Updates for 1.8 kubectl reference docs
* Kubeadm /docs/admin/kubeadm.md cleanup, editing. (#5681)
* Update docs/admin/kubeadm.md (mostly 1.8 related).
This is Fabrizio's work, which I'm committing along with my edits (in a commit on top of this).
* A few of my own edits to clarify and clean up some Markdown.
2017-09-29 04:46:51 +00:00
apiVersion: rbac.authorization.k8s.io/v1
2017-04-04 23:00:55 +00:00
kind: ClusterRole
metadata:
name: limited-impersonator
rules:
# Can impersonate the user "jane.doe@example.com"
- apiGroups: [""]
resources: ["users"]
verbs: ["impersonate"]
resourceNames: ["jane.doe@example.com"]
# Can impersonate the groups "developers" and "admins"
- apiGroups: [""]
resources: ["groups"]
- verbs: ["impersonate"]
resourceNames: ["developers","admins"]
# Can impersonate the extras field "scopes" with the values "view" and "development"
- apiGroups: ["authentication.k8s.io"]
resources: ["userextras/scopes"]
verbs: ["impersonate"]
resourceNames: ["view", "development"]
```
2016-02-26 11:54:48 +00:00
## APPENDIX
### Creating Certificates
2016-04-04 18:52:01 +00:00
When using client certificate authentication, you can generate certificates
2016-12-07 22:00:45 +00:00
using an existing deployment script or manually through `easyrsa` or `openssl.`
2016-04-04 18:52:01 +00:00
#### Using an Existing Deployment Script
2016-08-03 22:03:58 +00:00
**Using an existing deployment script** is implemented at
2017-03-10 03:13:12 +00:00
`cluster/saltbase/salt/generate-cert/make-ca-cert.sh` .
2016-04-04 18:52:01 +00:00
Execute this script with two parameters. The first is the IP address
2016-08-03 22:03:58 +00:00
of API server. The second is a list of subject alternate names in the form `IP:<ip-address> or DNS:<dns-name>` .
2016-04-04 18:52:01 +00:00
The script will generate three files: `ca.crt` , `server.crt` , and `server.key` .
2016-08-03 22:03:58 +00:00
Finally, add the following parameters into API server start parameters:
2016-04-04 18:52:01 +00:00
- `--client-ca-file=/srv/kubernetes/ca.crt`
2016-12-22 18:05:00 +00:00
- `--tls-cert-file=/srv/kubernetes/server.crt`
2016-04-04 18:52:01 +00:00
- `--tls-private-key-file=/srv/kubernetes/server.key`
2016-02-26 11:54:48 +00:00
2016-04-04 18:52:01 +00:00
#### easyrsa
2016-02-26 11:54:48 +00:00
**easyrsa** can be used to manually generate certificates for your cluster.
1. Download, unpack, and initialize the patched version of easyrsa3.
2017-08-15 11:58:24 +00:00
curl -L -O https://storage.googleapis.com/kubernetes-release/easy-rsa/easy-rsa.tar.gz
tar xzf easy-rsa.tar.gz
cd easy-rsa-master/easyrsa3
./easyrsa init-pki
2016-02-26 11:54:48 +00:00
1. Generate a CA. (`--batch` set automatic mode. `--req-cn` default CN to use.)
2017-08-15 11:58:24 +00:00
./easyrsa --batch "--req-cn=${MASTER_IP}@`date +%s`" build-ca nopass
2016-02-26 11:54:48 +00:00
1. Generate server certificate and key.
2017-09-16 00:30:05 +00:00
(build-server-full [filename]: Generate a keypair and sign locally for a client or server.)
2016-02-26 11:54:48 +00:00
2017-08-15 11:58:24 +00:00
./easyrsa --subject-alt-name="IP:${MASTER_IP}" build-server-full server nopass
2017-03-01 03:49:37 +00:00
1. Copy `pki/ca.crt` , `pki/issued/server.crt` , and `pki/private/server.key` to your directory.
2016-08-03 22:03:58 +00:00
1. Fill in and add the following parameters into the API server start parameters:
2016-04-04 18:52:01 +00:00
2017-08-15 11:58:24 +00:00
--client-ca-file=/yourdirectory/ca.crt
--tls-cert-file=/yourdirectory/server.crt
--tls-private-key-file=/yourdirectory/server.key
2016-04-04 18:52:01 +00:00
2016-08-03 22:03:58 +00:00
#### openssl
2016-02-26 11:54:48 +00:00
2017-08-22 23:46:27 +00:00
**openssl** can also be used to manually generate certificates for your cluster.
2016-02-26 11:54:48 +00:00
2016-04-04 18:52:01 +00:00
1. Generate a ca.key with 2048bit:
2017-08-15 11:58:24 +00:00
openssl genrsa -out ca.key 2048
2016-04-04 18:52:01 +00:00
1. According to the ca.key generate a ca.crt (use -days to set the certificate effective time):
2017-08-15 11:58:24 +00:00
openssl req -x509 -new -nodes -key ca.key -subj "/CN=${MASTER_IP}" -days 10000 -out ca.crt
2017-09-16 00:30:05 +00:00
1. Generate a server.key with 2048bit:
2016-04-04 18:52:01 +00:00
2017-08-15 11:58:24 +00:00
openssl genrsa -out server.key 2048
2016-04-04 18:52:01 +00:00
1. According to the server.key generate a server.csr:
2017-08-15 11:58:24 +00:00
openssl req -new -key server.key -subj "/CN=${MASTER_IP}" -out server.csr
2016-04-04 18:52:01 +00:00
1. According to the ca.key, ca.crt and server.csr generate the server.crt:
2017-08-15 11:58:24 +00:00
openssl x509 -req -in server.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out server.crt -days 10000
2016-02-26 11:54:48 +00:00
1. View the certificate.
2016-04-04 18:52:01 +00:00
2017-08-15 11:58:24 +00:00
openssl x509 -noout -text -in ./server.crt
2016-04-04 18:52:01 +00:00
2016-08-03 22:03:58 +00:00
Finally, do not forget to fill out and add the same parameters into the API server start parameters.
2017-03-21 14:37:55 +00:00
#### Certificates API
You can use the `certificates.k8s.io` API to provision
x509 certificates to use for authentication as documented
[here ](/docs/tasks/tls/managing-tls-in-a-cluster ).
