Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

kubeadm cert documentation #11093

Merged
merged 3 commits into from
Nov 29, 2018
Merged

kubeadm cert documentation #11093

merged 3 commits into from
Nov 29, 2018

Conversation

liztio
Copy link
Contributor

@liztio liztio commented Nov 19, 2018 •
edited
Loading

@k8s-ci-robot k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Nov 19, 2018
@k8sio-netlify-preview-bot
Copy link
Collaborator

k8sio-netlify-preview-bot commented Nov 19, 2018 •
edited
Loading

Deploy preview for kubernetes-io-vnext-staging processing.

Built with commit 590d6e0

https://app.netlify.com/sites/kubernetes-io-vnext-staging/deploys/5bff19a305c41723bdd8d0af

@k8s-ci-robot k8s-ci-robot added language/en Issues or PRs related to English language size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Nov 19, 2018
@liztio
Copy link
Contributor Author

liztio commented Nov 19, 2018

/milestone v1.13

@liztio
Copy link
Contributor Author

liztio commented Nov 19, 2018

/cc @Bradamant3

@liztio liztio changed the title Skeleton of kubeadm certs docs [wip] kubeadm cert documentation Nov 19, 2018
@k8s-ci-robot k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 19, 2018
@neolit123
Copy link
Member

/cc

@neolit123
Copy link
Member

/sig cluster-lifecycle

@k8s-ci-robot k8s-ci-robot added the sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle. label Nov 20, 2018
@neolit123
Copy link
Member

/priority critical-urgent

@k8s-ci-robot k8s-ci-robot added the priority/critical-urgent Highest priority. Must be actively worked on as someone's top priority right now. label Nov 20, 2018
@Bradamant3 Bradamant3 added this to the 1.13 milestone Nov 20, 2018
@Bradamant3 Bradamant3 removed the request for review from Rajakavitha1 November 20, 2018 20:19
@Bradamant3
Copy link
Contributor

/assign

@k8s-ci-robot k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Nov 20, 2018
@liztio liztio changed the title [wip] kubeadm cert documentation kubeadm cert documentation Nov 20, 2018
@k8s-ci-robot k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 20, 2018
neolit123
neolit123 approved these changes Nov 20, 2018
View reviewed changes
Copy link
Member

@neolit123 neolit123 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks @liztio i think this is well written.
found a couple of typos using a tool and commented about the location of the page.

content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md Outdated
## Cert usage

CSRs contain a certificate's name, domains, and IPs, but it does _not_ specify usages.
It is the responsibily of the CA to specify [the correct cert usages][cert-table] when issuing a certificate.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

responsibility

content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md Outdated

### kubeadm init
You can request an individual CSR with `kubeadm init phase certs apiserver --use-csr`.
The `--use-csr` flag can only be applied to invidiual phases; once [all certificates are in place][certs] you can run `kubeadm init --external-ca`.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

individual

content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md Outdated

To better integrate with external CAs, kubeadm can also produce certificate signing requests (CSRs).
A CSR represents a request for a CA to produce a signed certificate for a client.
In kubeadm terms, any certifate that would normally be signed by an on-disk CA can be produced as a CSR instead, but CAs themselves cannot.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

certificate

content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md Outdated Show resolved Hide resolved
content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md Outdated

## Setting up a signer

The kubernetes certificate authority does not work out of the box.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Kubernetes uppercase

@liztio
Copy link
Contributor Author

liztio commented Nov 20, 2018

@Bradamant3 I noticed that the styling of <h1> is off, there's no margin at the top. Should I only be using h2 and below in my page?

shavidissa
shavidissa reviewed Nov 21, 2018
View reviewed changes
content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md Outdated
You can request an individual CSR with `kubeadm init phase certs apiserver --use-csr`.
The `--use-csr` flag can only be applied to individual phases; once [all certificates are in place][certs] you can run `kubeadm init --external-ca`.

You can pass in a directory to output the CSRs to with `--csr-dir`.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You can pass in a directory to output the CSRs to with - > Remove the extra 'to' before with. :)

shavidissa
shavidissa reviewed Nov 21, 2018
View reviewed changes
content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md Outdated
The `--use-csr` flag can only be applied to individual phases; once [all certificates are in place][certs] you can run `kubeadm init --external-ca`.

You can pass in a directory to output the CSRs to with `--csr-dir`.
If it is not specified, the default certificate directory (`/etc/kubernetes/pki`) will be used.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If it is not specified, the default certificate directory (/etc/kubernetes/pki) will be used. - > If it is not specified, the default certificate directory (/etc/kubernetes/pki) is used.

(Keeping the sentece in the present tense.)

shavidissa
shavidissa reviewed Nov 21, 2018
View reviewed changes
content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md Outdated

You can pass in a directory to output the CSRs to with `--csr-dir`.
If it is not specified, the default certificate directory (`/etc/kubernetes/pki`) will be used.
Both the CSR and the accompanying private key will be output there. Once a certificate is signed, both it and the private key must be copied to the PKI directory (by default `/etc/kubernetes/pki`).
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor suggestion: :)
Both the CSR and the accompanying private key are given in the output. Once a certificate is signed, the certificate and the private key must be copied to the PKI directory (by default /etc/kubernetes/pki).

@liztio
Copy link
Contributor Author

liztio commented Nov 21, 2018

@shavidissa updated!

@neolit123
Copy link
Member

xref #10937

timothysc
timothysc approved these changes Nov 26, 2018
View reviewed changes
Copy link
Member

@timothysc timothysc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Bradamant3 ping
/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 26, 2018
@timothysc
Copy link
Member

@kubernetes/sig-docs-pr-reviews

This is ready to go!

@k8s-ci-robot k8s-ci-robot added the sig/docs Categorizes an issue or PR as relevant to SIG Docs. label Nov 26, 2018
@k8s-ci-robot k8s-ci-robot removed the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 28, 2018
@tengqm
Copy link
Contributor

tengqm commented Nov 29, 2018

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 29, 2018
@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tengqm, timothysc

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 29, 2018
@k8s-ci-robot k8s-ci-robot merged commit 7e11bde into kubernetes:dev-1.13 Nov 29, 2018
@Bradamant3 Bradamant3 mentioned this pull request Nov 29, 2018
Closed
2 tasks
tfogo pushed a commit that referenced this pull request Dec 1, 2018
@liztio @tfogo
kubeadm cert documentation (#11093)
1e19018 
* kubeadm certificate API and CSR documentation

* copyedits

* fix typo
@neolit123 neolit123 mentioned this pull request Dec 3, 2018
Closed
k8s-ci-robot pushed a commit that referenced this pull request Dec 4, 2018
@jimangel @k8s-ci-robot
Official 1.13 Release Docs (#11401)
27b7b45 
* Update metadata.generation behaviour for custom resources (#10705)

* update docs promoting plugins to beta (#10796)

* docs update to promote TaintBasedEvictions to beta (#10765)

* First Korean l10n work for dev-1.13 (#10719)

* Update outdated l10n(ko) contents (#10689)

fixes #10686

* Translate concepts/overview/what-is-kubernetes in Korean (#10690)

* Translate concepts/overview/what-is-kubernetes in Korean

* Feedback from ClaudiaJKang

* Translate concepts/overview/components in Korean (#10882)

* Translate concepts/overview/components in Korean #10717

* Translate concepts/overview/components in Korean

* Translate concepts/overview/components in Korean

* Apply Korean glossary: 서비스 어카운트

* Translate concepts/overview/kubernetes-api in Korean (#10773)

* Translate concepts/overview/kubernetes-api in Korean

* Applied feedback from ianychoi

* kubeadm: update the configuration docs to v1beta1 (#10959)

* kubeadm: add small v1beta1 related updates (#10988)

* ADD content/zh/docs/reference/setup-tools/kubeadm/kubeadm.md (#11031)

* ADD content/zh/docs/reference/setup-tools/kubeadm/kubeadm.md

* ADD content/zh/docs/reference/setup-tools/kubeadm/generated/kubeadm_init.md

* Update content/zh/docs/reference/setup-tools/kubeadm/kubeadm.md

Accepted

Co-Authored-By: YouthLab <[email protected]>

* do not change 'master' or 'worker' nodes to '主从'

* Doc updates for volume scheduling GA (#10743)

* Doc updates for volume scheduling GA

* Make trivial change to kick build

* Document nodelease feature (#10699)

* advanced audit doc for ModeBlockingStrict (#10203)

* Rename EncryptionConfig to EncryptionConfiguration (#11080)

EncryptionConfig was renamed to EncryptedConfiguration and added to
the `apiserver.config.k8s.io` API group in Kubernetes 1.13.

The feature was previously in alpha and was not handling versions
properly, which lead to an originally unnoticed `v1` in the docs.

* content/zh/docs/reference/setup-tools/kubeadm/kubeadm-init.md

* trsanlate create-cluster-kubeadm.md to chinese (#11041)

* trsanlate create-cluster-kubeadm.md to chinese

* Update create-cluster-kubeadm.md

* update the feature stage in v1.13 (#11307)

* update new feature gates to document (#11295)

* refresh controller role list on rbac description page (#11290)

* node labeling restriction docs (#10944)

* Update 1.13 docs for CSI GA (#10893)

* dynamic audit documentation (#9947)

* adds dynamic audit documentation

* Copyedit for clarity

See also inline question/s

* Fix feature state shortcode

* Update feature state

* changes wording for dynamic audit flag behavior

* Minor copyedit

* fix dynamic audit yaml

* adds api enablement command to dynamic audit docs

* change ordering dynamic audit appears in

* add references to dynamic audit in webhook backend

* reword dynamic audit reference

* updates stages field for audit sink object

* changes audit sink api definition; rewords policy

* kubeadm: remove kube-proxy workaround (#11162)

* zh-trans content/en/docs/setup/independent/install-kubeadm.md (#11338)

* zh-trans content/en/docs/setup/independent/install-kubeadm.md

* Update install-kubeadm.md

* Update dry run feature to beta (#11140)

* vSphere volume raw block support doc update (#10932)

* Add docs for Windows DNS configurations (#10036)

* Update docs for fields allowed at root of CRD schema (#9973)

* Add docs for Windows DNS configurations

* add device monitoring documentation (#9945)

* kubeadm: adds upgrade instructions for 1.13 (#11138)

* kubeadm: adds upgrade instructions for 1.13

Signed-off-by: Chuck Ha <[email protected]>

* add minor copyedits

Addressed a couple of copyedit comments a bit more cleanly.

* kubeadm: add improvements to HA docs (#11094)

* kubeadm: add information and diagrams for HA topologies

* kubeadm: update HA doc with simplified steps

* kubeadm: update HA doc with simplified steps

* edit ha, add new topology topic, reorder by weight

* troubleshoot markdown

* fix more markdown, fix links

* more markdown

* more markdown

* more markdown

* changes after reviewer comments

* add steps about Weave

* update note about stacked topology

* kubeadm external etcd HA upgrade 1.13 (#11364)

* kubeadm external etcd HA upgrade 1.13

Signed-off-by: Ruben Orduz <[email protected]>

* Update stacked controlplane steps

* kubeadm cert documentation (#11093)

* kubeadm certificate API and CSR documentation

* copyedits

* fix typo

* PR for diff docs (#10789)

* Empty commit against dev-1.13 for diff documentation

* Complete Declarative maangement with diff commands

* Second Korean l10n work for dev-1.13. (#11030)

* Update outdated l10n(ko) contents (#10915)
* Translate main menu for l10n(ko) docs (#10916)
* Translate tasks/run-application/horizontal-pod-autoscale-walkthrough (#10980)
* Translate content/ko/docs/concepts/overview/working-with-objects/kubernetes-object in Korean #11104 (#11332)
* Pick-right-solution page translates into Korean. (#11340)
* ko-trans: add jd/..., sap/..., ebay/..., homeoffice/... (#11336)
* Translate concept/workloads/pods/pod-overview.md (#11092)

Co-authored-by: June Yi <[email protected]>
Co-authored-by: Jesang Myung <[email protected]>
Co-authored-by: zerobig <[email protected]>
Co-authored-by: Claudia J.Kang <[email protected]>
Co-authored-by: lIuDuI <[email protected]>
Co-authored-by: Woojin Na(Eddie) <[email protected]>

* Rename encryption-at-rest related objects (#11059)

EncryptionConfig was renamed to EncryptedConfiguration and added to
the `apiserver.config.k8s.io` API group in Kubernetes 1.13.

The feature was previously in alpha and was not handling versions
properly, which lead to an originally unnoticed `v1` in the docs.

Also, the `--experimental-encryption-provider-config` flag is now called
just `--encryption-provider-config`.

* Documenting FlexVolume Resize alpha feature. (#10097)

* CR webhook conversion documentation (#10986)

* CR Conversion

* Addressing comments

* Addressing more comments

* Addressing even more comments

* Addressing even^2 more comments

* Remove references to etcd2 in v1.13 since support has been removed (#11414)

* Remove etcd2 references as etcd2 is deprecated

Link back to the v1.12 version of the etcd3 doc for
the etcd2->etcd3 migration instructions.

I updated the kube-apiserver reference manually,
unsure if that is auto-generated somehow.

The federation-apiserver can still potentially
support etcd2 so I didn't touch that.

* Remove outdated {master,node}.yaml files

There are master/node yaml files that reference
etcd2.service that are likely highly out of date.
I couldn't find any docs that actually reference
these templates so I removed them

* Address review comments

* Final Korean l10n work for dev-1.13 (#11440)

* Update outdated l10n(ko) contents (#11425)

fixes #11424

* Remove references to etcd2 in content/ko (#11416)

* Resolve conflicts against master for /ko contents (#11438)

* Fix unopened caution shortcode

* kubeadm: update the reference docs for 1.13 (#10960)

* docs update to promote TaintBasedEvictions to beta (#10765)

* First Korean l10n work for dev-1.13 (#10719)

* Update outdated l10n(ko) contents (#10689)

fixes #10686

* Translate concepts/overview/what-is-kubernetes in Korean (#10690)

* Translate concepts/overview/what-is-kubernetes in Korean

* Feedback from ClaudiaJKang

* Translate concepts/overview/components in Korean (#10882)

* Translate concepts/overview/components in Korean #10717

* Translate concepts/overview/components in Korean

* Translate concepts/overview/components in Korean

* Apply Korean glossary: 서비스 어카운트

* Translate concepts/overview/kubernetes-api in Korean (#10773)

* Translate concepts/overview/kubernetes-api in Korean

* Applied feedback from ianychoi

* kubeadm: update the configuration docs to v1beta1 (#10959)

* kubeadm: add small v1beta1 related updates (#10988)

* update new feature gates to document (#11295)

* Update dry run feature to beta (#11140)

* kubeadm: add improvements to HA docs (#11094)

* kubeadm: add information and diagrams for HA topologies

* kubeadm: update HA doc with simplified steps

* kubeadm: update HA doc with simplified steps

* edit ha, add new topology topic, reorder by weight

* troubleshoot markdown

* fix more markdown, fix links

* more markdown

* more markdown

* more markdown

* changes after reviewer comments

* add steps about Weave

* update note about stacked topology

* kubeadm: update reference docs

- add section about working with phases under kubeadm-init.md
- update GA / beta status of features
- kubeadm alpha phase was moved to kubeadm init phase
- new commands were added under kubeadm alpha
- included new CoreDNS usage examples

* Generate components and tools reference

* Add generated federation API Reference (#11491)

* Add generated federation API Reference

* Add front matter to federation reference

* Remove whitespace from federation front matter

* Remove more whitespace from federation front matter

* Remove superfluous kubefed reference

* Add frontmatter to generated kubefed reference

* Fix kubefed reference page frontmatter

* Generate kubectl reference docs 1.13 (#11487)

* Generate kubectl reference docs 1.13

* Fix links in kubectl reference

* Add 1.13 API reference (#11489)

* Update config.toml (#11486)

* Update config.toml

Preparing for 1.13 release, updating the config.toml and dropping the 1.8 docs reference.

* update dot releases and docsbranch typo

* adding .Site. to Params.currentUrl (#11503)

see #11502 for context

* Add 1.13 Release notes (#11499)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@shavidissa shavidissa shavidissa left review comments

@neolit123 neolit123 neolit123 approved these changes

@timothysc timothysc timothysc approved these changes

@jimangel jimangel Awaiting requested review from jimangel

@Bradamant3 Bradamant3 Awaiting requested review from Bradamant3

Assignees

@timothysc timothysc

@tengqm tengqm

@Bradamant3 Bradamant3

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. language/en Issues or PRs related to English language lgtm "Looks good to me", indicates that a PR is ready to be merged. priority/critical-urgent Highest priority. Must be actively worked on as someone's top priority right now. sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle. sig/docs Categorizes an issue or PR as relevant to SIG Docs. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Milestone
1.13
Development

Successfully merging this pull request may close these issues.
8 participants
@liztio @k8sio-netlify-preview-bot @neolit123 @Bradamant3 @timothysc @tengqm @k8s-ci-robot @shavidissa