You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/en/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,7 +10,7 @@ content_type: concept
10
10
11
11
<!-- overview -->
12
12
13
-
In a Kubernetes cluster, the components on the worker nodes - kubelet and kube-proxy - need to communicate with Kubernetes master components, specifically kube-apiserver.
13
+
In a Kubernetes cluster, the components on the worker nodes - kubelet and kube-proxy - need to communicate with Kubernetes control plane components, specifically kube-apiserver.
14
14
In order to ensure that communication is kept private, not interfered with, and ensure that each component of the cluster is talking to another trusted component, we strongly
15
15
recommend using client TLS certificates on nodes.
16
16
@@ -44,7 +44,7 @@ Note that the above process depends upon:
44
44
All of the following are responsibilities of whoever sets up and manages the cluster:
45
45
46
46
1. Creating the CA key and certificate
47
-
2. Distributing the CA certificate to the master nodes, where kube-apiserver is running
47
+
2. Distributing the CA certificate to the control plane nodes, where kube-apiserver is running
48
48
3. Creating a key and certificate for each kubelet; strongly recommended to have a unique one, with a unique CN, for each kubelet
49
49
4. Signing the kubelet certificate using the CA key
50
50
5. Distributing the kubelet key and signed certificate to the specific node on which the kubelet is running
@@ -90,9 +90,9 @@ In addition, you need your Kubernetes Certificate Authority (CA).
90
90
## Certificate Authority
91
91
92
92
As without bootstrapping, you will need a Certificate Authority (CA) key and certificate. As without bootstrapping, these will be used
93
-
to sign the kubelet certificate. As before, it is your responsibility to distribute them to master nodes.
93
+
to sign the kubelet certificate. As before, it is your responsibility to distribute them to control plane nodes.
94
94
95
-
For the purposes of this document, we will assume these have been distributed to master nodes at `/var/lib/kubernetes/ca.pem` (certificate) and `/var/lib/kubernetes/ca-key.pem` (key).
95
+
For the purposes of this document, we will assume these have been distributed to control plane nodes at `/var/lib/kubernetes/ca.pem` (certificate) and `/var/lib/kubernetes/ca-key.pem` (key).
96
96
We will refer to these as "Kubernetes CA certificate and key".
97
97
98
98
All Kubernetes components that use these certificates - kubelet, kube-apiserver, kube-controller-manager - assume the key and certificate to be PEM-encoded.
@@ -234,7 +234,7 @@ In order for the controller-manager to sign certificates, it needs the following
234
234
235
235
### Access to key and certificate
236
236
237
-
As described earlier, you need to create a Kubernetes CA key and certificate, and distribute it to the master nodes.
237
+
As described earlier, you need to create a Kubernetes CA key and certificate, and distribute it to the control plane nodes.
238
238
These will be used by the controller-manager to sign the kubelet certificates.
239
239
240
240
Since these signed certificates will, in turn, be used by the kubelet to authenticate as a regular kubelet to kube-apiserver, it is important that the CA
@@ -319,7 +319,7 @@ collection.
319
319
320
320
## kubelet configuration
321
321
322
-
Finally, with the master nodes properly set up and all of the necessary authentication and authorization in place, we can configure the kubelet.
322
+
Finally, with the control plane nodes properly set up and all of the necessary authentication and authorization in place, we can configure the kubelet.
323
323
324
324
The kubelet requires the following configuration to bootstrap:
0 commit comments