You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/en/docs/setup/best-practices/certificates.md
+69-53Lines changed: 69 additions & 53 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,12 +9,12 @@ weight: 50
9
9
<!-- overview -->
10
10
11
11
Kubernetes requires PKI certificates for authentication over TLS.
12
-
If you install Kubernetes with [kubeadm](/docs/reference/setup-tools/kubeadm/), the certificates that your cluster requires are automatically generated.
13
-
You can also generate your own certificates -- for example, to keep your private keys more secure by not storing them on the API server.
12
+
If you install Kubernetes with [kubeadm](/docs/reference/setup-tools/kubeadm/), the certificates
13
+
that your cluster requires are automatically generated.
14
+
You can also generate your own certificates -- for example, to keep your private keys more secure
15
+
by not storing them on the API server.
14
16
This page explains the certificates that your cluster requires.
15
17
16
-
17
-
18
18
<!-- body -->
19
19
20
20
## How certificates are used by your cluster
@@ -33,24 +33,30 @@ Kubernetes requires PKI for the following operations:
33
33
* Client and server certificates for the [front-proxy](/docs/tasks/extend-kubernetes/configure-aggregation-layer/)
34
34
35
35
{{< note >}}
36
-
`front-proxy` certificates are required only if you run kube-proxy to support [an extension API server](/docs/tasks/extend-kubernetes/setup-extension-api-server/).
36
+
`front-proxy` certificates are required only if you run kube-proxy to support
37
+
[an extension API server](/docs/tasks/extend-kubernetes/setup-extension-api-server/).
37
38
{{< /note >}}
38
39
39
40
etcd also implements mutual TLS to authenticate clients and peers.
40
41
41
42
## Where certificates are stored
42
43
43
-
If you install Kubernetes with kubeadm, most certificates are stored in `/etc/kubernetes/pki`. All paths in this documentation are relative to that directory, with the exception of user account certificates which kubeadm places in `/etc/kubernetes`.
44
+
If you install Kubernetes with kubeadm, most certificates are stored in `/etc/kubernetes/pki`.
45
+
All paths in this documentation are relative to that directory, with the exception of user account
46
+
certificates which kubeadm places in `/etc/kubernetes`.
44
47
45
48
## Configure certificates manually
46
49
47
-
If you don't want kubeadm to generate the required certificates, you can create them using a single root CA or by providing all certificates. See [Certificates](/docs/tasks/administer-cluster/certificates/) for details on creating your own certificate authority.
48
-
See [Certificate Management with kubeadm](/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/) for more on managing certificates.
49
-
50
+
If you don't want kubeadm to generate the required certificates, you can create them using a
51
+
single root CA or by providing all certificates. See [Certificates](/docs/tasks/administer-cluster/certificates/)
52
+
for details on creating your own certificate authority. See
53
+
[Certificate Management with kubeadm](/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/)
54
+
for more on managing certificates.
50
55
51
56
### Single root CA
52
57
53
-
You can create a single root CA, controlled by an administrator. This root CA can then create multiple intermediate CAs, and delegate all further creation to Kubernetes itself.
58
+
You can create a single root CA, controlled by an administrator. This root CA can then create
59
+
multiple intermediate CAs, and delegate all further creation to Kubernetes itself.
54
60
55
61
Required CAs:
56
62
@@ -60,7 +66,8 @@ Required CAs:
60
66
| etcd/ca.crt,key | etcd-ca | For all etcd-related functions |
61
67
| front-proxy-ca.crt,key | kubernetes-front-proxy-ca | For the [front-end proxy](/docs/tasks/extend-kubernetes/configure-aggregation-layer/)|
62
68
63
-
On top of the above CAs, it is also necessary to get a public/private key pair for service account management, `sa.key` and `sa.pub`.
69
+
On top of the above CAs, it is also necessary to get a public/private key pair for service account
70
+
management, `sa.key` and `sa.pub`.
64
71
The following example illustrates the CA key and certificate files shown in the previous table:
65
72
66
73
```
@@ -71,43 +78,49 @@ The following example illustrates the CA key and certificate files shown in the
71
78
/etc/kubernetes/pki/front-proxy-ca.crt
72
79
/etc/kubernetes/pki/front-proxy-ca.key
73
80
```
81
+
74
82
### All certificates
75
83
76
84
If you don't wish to copy the CA private keys to your cluster, you can generate all certificates yourself.
77
85
78
86
Required certificates:
79
87
80
-
| Default CN | Parent CA | O (in Subject) | kind | hosts (SAN)|
where `kind` maps to one or more of the [x509 key usage](https://pkg.go.dev/k8s.io/api/certificates/v1beta1#KeyUsage) types:
102
+
where `kind` maps to one or more of the x509 key usage, which is also documented in the
103
+
`.spec.usages` of a [CertificateSigningRequest](/docs/reference/kubernetes-api/authentication-resources/certificate-signing-request-v1#CertificateSigningRequest)
| server | digital signature, key encipherment, server auth |
99
109
| client | digital signature, key encipherment, client auth |
100
110
101
111
{{< note >}}
102
-
Hosts/SAN listed above are the recommended ones for getting a working cluster; if required by a specific setup, it is possible to add additional SANs on all the server certificates.
112
+
Hosts/SAN listed above are the recommended ones for getting a working cluster; if required by a
113
+
specific setup, it is possible to add additional SANs on all the server certificates.
103
114
{{< /note >}}
104
115
105
116
{{< note >}}
106
117
For kubeadm users only:
107
118
108
-
* The scenario where you are copying to your cluster CA certificates without private keys is referred as external CA in the kubeadm documentation.
109
-
* If you are comparing the above list with a kubeadm generated PKI, please be aware that `kube-etcd`, `kube-etcd-peer` and `kube-etcd-healthcheck-client` certificates
110
-
are not generated in case of external etcd.
119
+
* The scenario where you are copying to your cluster CA certificates without private keys is
120
+
referred as external CA in the kubeadm documentation.
121
+
* If you are comparing the above list with a kubeadm generated PKI, please be aware that
122
+
`kube-etcd`, `kube-etcd-peer` and `kube-etcd-healthcheck-client` certificates are not generated
123
+
in case of external etcd.
111
124
112
125
{{< /note >}}
113
126
@@ -116,31 +129,32 @@ For kubeadm users only:
116
129
Certificates should be placed in a recommended path (as used by [kubeadm](/docs/reference/setup-tools/kubeadm/)).
117
130
Paths should be specified using the given argument regardless of location.
The following example illustrates the file paths [from the previous tables](/docs/setup/best-practices/certificates/#certificate-paths) you need to provide if you are generating all of your own keys and certificates:
156
+
The following example illustrates the file paths [from the previous tables](#certificate-paths)
157
+
you need to provide if you are generating all of your own keys and certificates:
144
158
145
159
```
146
160
/etc/kubernetes/pki/etcd/ca.key
@@ -170,15 +184,17 @@ The following example illustrates the file paths [from the previous tables](/doc
170
184
171
185
You must manually configure these administrator account and service accounts:
172
186
173
-
| filename | credential name | Default CN | O (in Subject) |
The value of `<nodeName>` for `kubelet.conf`**must** match precisely the value of the node name provided by the kubelet as it registers with the apiserver. For further details, read the [Node Authorization](/docs/reference/access-authn-authz/node/).
195
+
The value of `<nodeName>` for `kubelet.conf`**must** match precisely the value of the node name
196
+
provided by the kubelet as it registers with the apiserver. For further details, read the
0 commit comments