Skip to content

Commit 17119b9

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #48401 from windsonsea/nodefor
Clean up best-practices: certificates and node-conformance
2 parents 6d4ef64 + 1d24167 commit 17119b9

File tree

2 files changed

+63
-55
lines changed

2 files changed

+63
-55
lines changed

‎content/en/docs/setup/best-practices/certificates.md

Lines changed: 42 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -42,15 +42,19 @@ Kubernetes requires PKI for the following operations:
4242

4343
### Kubelet's server and client certificates
4444

45-
To establish a secure connection and authenticate itself to the kubelet, the API Server
46-
requires a client certificate and key pair.
45+
To establish a secure connection and authenticate itself to the kubelet, the API Server
46+
requires a client certificate and key pair.
4747

48-
In this scenario, there are two approaches for certificate usage:
49-
using shared certificates or separate certificates;
48+
In this scenario, there are two approaches for certificate usage:
5049

51-
* Shared Certificates: The kube-apiserver can utilize the same certificate and key pair it uses to authenticate its clients. This means that the existing certificates, such as `apiserver.crt` and `apiserver.key`, can be used for communicating with the kubelet servers.
50+
* Shared Certificates: The kube-apiserver can utilize the same certificate and key pair it uses
51+
to authenticate its clients. This means that the existing certificates, such as `apiserver.crt`
52+
and `apiserver.key`, can be used for communicating with the kubelet servers.
5253

53-
* Separate Certificates: Alternatively, the kube-apiserver can generate a new client certificate and key pair to authenticate its communication with the kubelet servers. In this case, a distinct certificate named `kubelet-client.crt` and its corresponding private key, `kubelet-client.key` are created.
54+
* Separate Certificates: Alternatively, the kube-apiserver can generate a new client certificate
55+
and key pair to authenticate its communication with the kubelet servers. In this case,
56+
a distinct certificate named `kubelet-client.crt` and its corresponding private key,
57+
`kubelet-client.key` are created.
5458

5559
{{< note >}}
5660
`front-proxy` certificates are required only if you run kube-proxy to support
@@ -80,7 +84,7 @@ multiple intermediate CAs, and delegate all further creation to Kubernetes itsel
8084

8185
Required CAs:
8286

83-
| path | Default CN | description |
87+
| Path | Default CN | Description |
8488
|------------------------|---------------------------|----------------------------------|
8589
| ca.crt,key | kubernetes-ca | Kubernetes general CA |
8690
| etcd/ca.crt,key | etcd-ca | For all etcd-related functions |
@@ -111,7 +115,7 @@ Required certificates:
111115
| kube-etcd-peer | etcd-ca | | server, client | `<hostname>`, `<Host_IP>`, `localhost`, `127.0.0.1` |
112116
| kube-etcd-healthcheck-client | etcd-ca | | client | |
113117
| kube-apiserver-etcd-client | etcd-ca | | client | |
114-
| kube-apiserver | kubernetes-ca | | server | `<hostname>`, `<Host_IP>`, `<advertise_IP>`, `[1]` |
118+
| kube-apiserver | kubernetes-ca | | server | `<hostname>`, `<Host_IP>`, `<advertise_IP>`[^1] |
115119
| kube-apiserver-kubelet-client | kubernetes-ca | system:masters | client | |
116120
| front-proxy-client | kubernetes-front-proxy-ca | | client | |
117121

@@ -121,7 +125,7 @@ a less privileged group can be used. kubeadm uses the `kubeadm:cluster-admins` g
121125
that purpose.
122126
{{< /note >}}
123127

124-
[1]: any other IP or DNS name you contact your cluster on (as used by [kubeadm](/docs/reference/setup-tools/kubeadm/)
128+
[^1]: any other IP or DNS name you contact your cluster on (as used by [kubeadm](/docs/reference/setup-tools/kubeadm/)
125129
the load balancer stable IP and/or DNS name, `kubernetes`, `kubernetes.default`, `kubernetes.default.svc`,
126130
`kubernetes.default.svc.cluster`, `kubernetes.default.svc.cluster.local`)
127131

@@ -155,22 +159,22 @@ For kubeadm users only:
155159
Certificates should be placed in a recommended path (as used by [kubeadm](/docs/reference/setup-tools/kubeadm/)).
156160
Paths should be specified using the given argument regardless of location.
157161

158-
| Default CN | recommended key path | recommended cert path | command | key argument | cert argument |
159-
|------------------------------|------------------------------|-----------------------------|-------------------------|------------------------------|-------------------------------------------|
160-
| etcd-ca | etcd/ca.key | etcd/ca.crt | kube-apiserver | | --etcd-cafile |
161-
| kube-apiserver-etcd-client | apiserver-etcd-client.key | apiserver-etcd-client.crt | kube-apiserver | --etcd-keyfile | --etcd-certfile |
162-
| kubernetes-ca | ca.key | ca.crt | kube-apiserver | | --client-ca-file |
163-
| kubernetes-ca | ca.key | ca.crt | kube-controller-manager | --cluster-signing-key-file | --client-ca-file, --root-ca-file, --cluster-signing-cert-file |
164-
| kube-apiserver | apiserver.key | apiserver.crt | kube-apiserver | --tls-private-key-file | --tls-cert-file |
165-
| kube-apiserver-kubelet-client| apiserver-kubelet-client.key | apiserver-kubelet-client.crt| kube-apiserver | --kubelet-client-key | --kubelet-client-certificate |
166-
| front-proxy-ca | front-proxy-ca.key | front-proxy-ca.crt | kube-apiserver | | --requestheader-client-ca-file |
167-
| front-proxy-ca | front-proxy-ca.key | front-proxy-ca.crt | kube-controller-manager | | --requestheader-client-ca-file |
168-
| front-proxy-client | front-proxy-client.key | front-proxy-client.crt | kube-apiserver | --proxy-client-key-file | --proxy-client-cert-file |
169-
| etcd-ca | etcd/ca.key | etcd/ca.crt | etcd | | --trusted-ca-file, --peer-trusted-ca-file |
170-
| kube-etcd | etcd/server.key | etcd/server.crt | etcd | --key-file | --cert-file |
171-
| kube-etcd-peer | etcd/peer.key | etcd/peer.crt | etcd | --peer-key-file | --peer-cert-file |
172-
| etcd-ca | | etcd/ca.crt | etcdctl | | --cacert |
173-
| kube-etcd-healthcheck-client | etcd/healthcheck-client.key | etcd/healthcheck-client.crt | etcdctl | --key | --cert |
162+
| DefaultCN | recommendedkeypath | recommendedcertpath | command | keyargument | certargument |
163+
| --------- | ------------------ | ------------------- | ------- | ----------- | ------------ |
164+
| etcd-ca | etcd/ca.key | etcd/ca.crt | kube-apiserver | | --etcd-cafile |
165+
| kube-apiserver-etcd-client | apiserver-etcd-client.key | apiserver-etcd-client.crt | kube-apiserver | --etcd-keyfile | --etcd-certfile |
166+
| kubernetes-ca | ca.key | ca.crt | kube-apiserver | | --client-ca-file |
167+
| kubernetes-ca | ca.key | ca.crt | kube-controller-manager | --cluster-signing-key-file | --client-ca-file,--root-ca-file,--cluster-signing-cert-file |
168+
| kube-apiserver | apiserver.key | apiserver.crt| kube-apiserver | --tls-private-key-file | --tls-cert-file |
169+
| kube-apiserver-kubelet-client | apiserver-kubelet-client.key | apiserver-kubelet-client.crt | kube-apiserver | --kubelet-client-key | --kubelet-client-certificate |
170+
| front-proxy-ca | front-proxy-ca.key | front-proxy-ca.crt | kube-apiserver | | --requestheader-client-ca-file |
171+
| front-proxy-ca | front-proxy-ca.key | front-proxy-ca.crt | kube-controller-manager | | --requestheader-client-ca-file |
172+
| front-proxy-client | front-proxy-client.key | front-proxy-client.crt | kube-apiserver | --proxy-client-key-file | --proxy-client-cert-file |
173+
| etcd-ca | etcd/ca.key | etcd/ca.crt | etcd | | --trusted-ca-file,--peer-trusted-ca-file |
174+
| kube-etcd | etcd/server.key | etcd/server.crt | etcd | --key-file | --cert-file |
175+
| kube-etcd-peer | etcd/peer.key | etcd/peer.crt | etcd | --peer-key-file | --peer-cert-file |
176+
| etcd-ca| | etcd/ca.crt | etcdctl | | --cacert |
177+
| kube-etcd-healthcheck-client | etcd/healthcheck-client.key | etcd/healthcheck-client.crt | etcdctl | --key | --cert |
174178

175179
Same considerations apply for the service account key pair:
176180

@@ -206,11 +210,12 @@ you need to provide if you are generating all of your own keys and certificates:
206210
/etc/kubernetes/pki/sa.key
207211
/etc/kubernetes/pki/sa.pub
208212
```
213+
209214
## Configure certificates for user accounts
210215

211-
You must manually configure these administrator account and service accounts:
216+
You must manually configure these administrator accounts and service accounts:
212217

213-
| filename | credential name | Default CN | O (in Subject) |
218+
| Filename | Credential name | Default CN | O (in Subject) |
214219
|-------------------------|----------------------------|-------------------------------------|------------------------|
215220
| admin.conf | default-admin | kubernetes-admin | `<admin-group>` |
216221
| super-admin.conf | default-super-admin | kubernetes-super-admin | system:masters |
@@ -240,20 +245,21 @@ Another is in `super-admin.conf` that has `Subject: O = system:masters, CN = kub
240245
This file is generated only on the node where `kubeadm init` was called.
241246
{{< /note >}}
242247

243-
1. For each config, generate an x509 cert/key pair with the given CN and O.
248+
1. For each configuration, generate an x509 certificate/key pair with the
249+
given Common Name (CN) and Organization (O).
244250

245-
1. Run `kubectl` as follows for each config:
251+
1. Run `kubectl` as follows for each configuration:
246252

247-
```
248-
KUBECONFIG=<filename> kubectl config set-cluster default-cluster --server=https://<host ip>:6443 --certificate-authority <path-to-kubernetes-ca> --embed-certs
249-
KUBECONFIG=<filename> kubectl config set-credentials <credential-name> --client-key <path-to-key>.pem --client-certificate <path-to-cert>.pem --embed-certs
250-
KUBECONFIG=<filename> kubectl config set-context default-system --cluster default-cluster --user <credential-name>
251-
KUBECONFIG=<filename> kubectl config use-context default-system
252-
```
253+
```
254+
KUBECONFIG=<filename> kubectl config set-cluster default-cluster --server=https://<host ip>:6443 --certificate-authority <path-to-kubernetes-ca> --embed-certs
255+
KUBECONFIG=<filename> kubectl config set-credentials <credential-name> --client-key <path-to-key>.pem --client-certificate <path-to-cert>.pem --embed-certs
256+
KUBECONFIG=<filename> kubectl config set-context default-system --cluster default-cluster --user <credential-name>
257+
KUBECONFIG=<filename> kubectl config use-context default-system
258+
```
253259

254260
These files are used as follows:
255261

256-
| filename | command | comment |
262+
| Filename | Command | Comment |
257263
|-------------------------|-------------------------|-----------------------------------------------------------------------|
258264
| admin.conf | kubectl | Configures administrator user for the cluster |
259265
| super-admin.conf | kubectl | Configures super administrator user for the cluster |

‎content/en/docs/setup/best-practices/node-conformance.md

Lines changed: 21 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ title: Validate node setup
55
weight: 30
66
---
77

8-
98
## Node Conformance Test
109

1110
*Node conformance test* is a containerized test framework that provides a system
@@ -19,40 +18,42 @@ To run node conformance test, a node must satisfy the same prerequisites as a
1918
standard Kubernetes node. At a minimum, the node should have the following
2019
daemons installed:
2120

22-
* CRI-compatible container runtimes such as Docker, Containerd and CRI-O
23-
* Kubelet
21+
* CRI-compatible container runtimes such as Docker, containerd and CRI-O
22+
* kubelet
2423

2524
## Running Node Conformance Test
2625

2726
To run the node conformance test, perform the following steps:
27+
2828
1. Work out the value of the `--kubeconfig` option for the kubelet; for example:
2929
`--kubeconfig=/var/lib/kubelet/config.yaml`.
3030
Because the test framework starts a local control plane to test the kubelet,
3131
use `http://localhost:8080` as the URL of the API server.
3232
There are some other kubelet command line parameters you may want to use:
33-
* `--cloud-provider`: If you are using `--cloud-provider=gce`, you should
34-
remove the flag to run the test.
33+
34+
* `--cloud-provider`: If you are using `--cloud-provider=gce`, you should
35+
remove the flag to run the test.
3536

36-
2. Run the node conformance test with command:
37+
1. Run the node conformance test with command:
3738

38-
```shell
39-
# $CONFIG_DIR is the pod manifest path of your Kubelet.
40-
# $LOG_DIR is the test output path.
41-
sudo docker run -it --rm --privileged --net=host \
42-
-v /:/rootfs -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \
43-
registry.k8s.io/node-test:0.2
44-
```
39+
```shell
40+
# $CONFIG_DIR is the pod manifest path of your kubelet.
41+
# $LOG_DIR is the test output path.
42+
sudo docker run -it --rm --privileged --net=host \
43+
-v /:/rootfs -v $CONFIG_DIR:$CONFIG_DIR -v $LOG_DIR:/var/result \
44+
registry.k8s.io/node-test:0.2
45+
```
4546

4647
## Running Node Conformance Test for Other Architectures
4748

4849
Kubernetes also provides node conformance test docker images for other
4950
architectures:
5051

51-
Arch | Image |
52-
--------|:-----------------:|
53-
amd64 | node-test-amd64 |
54-
arm | node-test-arm |
55-
arm64 | node-test-arm64 |
52+
| Arch | Image |
53+
|--------|:-----------------:|
54+
| amd64 | node-test-amd64 |
55+
| arm | node-test-arm |
56+
| arm64 | node-test-arm64 |
5657

5758
## Running Selected Test
5859

@@ -76,7 +77,8 @@ sudo docker run -it --rm --privileged --net=host \
7677
registry.k8s.io/node-test:0.2
7778
```
7879

79-
Node conformance test is a containerized version of [node e2e test](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-node/e2e-node-tests.md).
80+
Node conformance test is a containerized version of
81+
[node e2e test](https://github.com/kubernetes/community/blob/master/contributors/devel/sig-node/e2e-node-tests.md).
8082
By default, it runs all conformance tests.
8183

8284
Theoretically, you can run any node e2e test if you configure the container and

0 commit comments

Comments
 (0)