Kubernetes aggregation certificates - apiserver client authentication allowed namesKubernetes python client change name of ConfigMapIn AWS EKS, what security group allows access to master node from kubernetes client?Traefik doesn't pick TLS certificates secrets from the ingress definition in KubernetesKubernetes don't start after change in kube-apiserver --authentication-mode=tokenMonitoring internal Kubernetes certificatesEnable CORS for GKE Kubernetes API
Gambler's Fallacy Dice
Why is python script running in background consuming 100 % CPU?
How to safely discharge oneself
Bash - Execute two commands and get exit status 1 if first fails
Can the word crowd refer to just 10 people?
Why does Taylor’s series “work”?
Novel where a cube cooled below absolute zero makes a hole in reality
Is the free group on two generators generated by two elements?
How do you cope with rejection?
Is presenting a play showing Military charactes in a bad light a crime in the US?
Was Tyrion always a poor strategist?
What city and town structures are important in a low fantasy medieval world?
Blender 2.8 How to rotate viewport 90 deg after Shift +7
Have the writers and actors of Game Of Thrones responded to its poor reception?
Working hours and productivity expectations for game artists and programmers
Greek theta instead of lower case þ (Icelandic) in TexStudio
Why are Marine Le Pen's possible connections with Steve Bannon something worth investigating?
Are there any crystals that are theoretically possible, but haven't yet been made?
Why is so much ransomware breakable?
Is being an extrovert a necessary condition to be a manager?
How can sister protect herself from impulse purchases with a credit card?
On a piano, are the effects of holding notes and the sustain pedal the same for a single chord?
Hotel booking: Why is Agoda much cheaper than booking.com?
What's is the easiest way to purchase a stock and hold it
Kubernetes aggregation certificates - apiserver client authentication allowed names
Kubernetes python client change name of ConfigMapIn AWS EKS, what security group allows access to master node from kubernetes client?Traefik doesn't pick TLS certificates secrets from the ingress definition in KubernetesKubernetes don't start after change in kube-apiserver --authentication-mode=tokenMonitoring internal Kubernetes certificatesEnable CORS for GKE Kubernetes API
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
Definitions I'm using in this question:
- Main apiserver: the core kube-apiserver
- Extension apiserver: an addon like metrics-server
I am reading through the configure aggregation layer guide and I don't understand the main apiserver's use of --requestheader-allowed-names. In section Kubernetes Apiserver Client Authentication it says:
The connection must be made using a client certificate whose CN is one of those listed in --requestheader-allowed-names. Note: You can set this option to blank as --requestheader-allowed-names="". This will indicate to an extension apiserver that any CN is acceptable.
It makes it sound like the main apiserver is responsible for setting this. Surely the extension apiserver would be in control of this and determine what is acceptable? Why configure this on the main apiserver at all? I.e. The client certificate common names are what they are and it's up to the extension apiserver to accept/reject these?
Or is that doc section mixing options that are passed to both the main and extension apiservers?
kubernetes
asked May 7 at 1:24
Fred ClausenFred Clausen
1,3461620
add a comment |
Definitions I'm using in this question:
- Main apiserver: the core kube-apiserver
- Extension apiserver: an addon like metrics-server
I am reading through the configure aggregation layer guide and I don't understand the main apiserver's use of --requestheader-allowed-names. In section Kubernetes Apiserver Client Authentication it says:
The connection must be made using a client certificate whose CN is one of those listed in --requestheader-allowed-names. Note: You can set this option to blank as --requestheader-allowed-names="". This will indicate to an extension apiserver that any CN is acceptable.
It makes it sound like the main apiserver is responsible for setting this. Surely the extension apiserver would be in control of this and determine what is acceptable? Why configure this on the main apiserver at all? I.e. The client certificate common names are what they are and it's up to the extension apiserver to accept/reject these?
Or is that doc section mixing options that are passed to both the main and extension apiservers?
kubernetes
asked May 7 at 1:24
Fred ClausenFred Clausen
1,3461620
add a comment |
Definitions I'm using in this question:
- Main apiserver: the core kube-apiserver
- Extension apiserver: an addon like metrics-server
I am reading through the configure aggregation layer guide and I don't understand the main apiserver's use of --requestheader-allowed-names. In section Kubernetes Apiserver Client Authentication it says:
The connection must be made using a client certificate whose CN is one of those listed in --requestheader-allowed-names. Note: You can set this option to blank as --requestheader-allowed-names="". This will indicate to an extension apiserver that any CN is acceptable.
It makes it sound like the main apiserver is responsible for setting this. Surely the extension apiserver would be in control of this and determine what is acceptable? Why configure this on the main apiserver at all? I.e. The client certificate common names are what they are and it's up to the extension apiserver to accept/reject these?
Or is that doc section mixing options that are passed to both the main and extension apiservers?
kubernetes
asked May 7 at 1:24
Fred ClausenFred Clausen
1,3461620
Definitions I'm using in this question:
- Main apiserver: the core kube-apiserver
- Extension apiserver: an addon like metrics-server
I am reading through the configure aggregation layer guide and I don't understand the main apiserver's use of --requestheader-allowed-names. In section Kubernetes Apiserver Client Authentication it says:
The connection must be made using a client certificate whose CN is one of those listed in --requestheader-allowed-names. Note: You can set this option to blank as --requestheader-allowed-names="". This will indicate to an extension apiserver that any CN is acceptable.
It makes it sound like the main apiserver is responsible for setting this. Surely the extension apiserver would be in control of this and determine what is acceptable? Why configure this on the main apiserver at all? I.e. The client certificate common names are what they are and it's up to the extension apiserver to accept/reject these?
Or is that doc section mixing options that are passed to both the main and extension apiservers?
kubernetes
kubernetes
asked May 7 at 1:24
Fred ClausenFred Clausen
1,3461620
asked May 7 at 1:24
Fred ClausenFred Clausen
1,3461620
asked May 7 at 1:24
Fred ClausenFred Clausen
1,3461620
asked May 7 at 1:24
Fred ClausenFred Clausen
1,3461620
asked May 7 at 1:24
Fred ClausenFred Clausen
1,3461620
1,3461620
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
I think I understand now why the main kube-apiserver needs this allowed names list: The kube-apiserver is a frontend for all the extension apiservers. So the requests always go through kube-apiserver first; it aggregates the requests and then passes them onto the correct backend extension apiserver. Hence it'll need to know which CN's to accept. I.e. a request to an extension server would go:
client request -> kube-apiserver -> extension-apiserver
The extension apiserver would then also check the CN once it received the request after it was routed there by main kube-apiserver.
answered 2 days ago
Fred ClausenFred Clausen
1,3461620
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f966122%2fkubernetes-aggregation-certificates-apiserver-client-authentication-allowed-na%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
I think I understand now why the main kube-apiserver needs this allowed names list: The kube-apiserver is a frontend for all the extension apiservers. So the requests always go through kube-apiserver first; it aggregates the requests and then passes them onto the correct backend extension apiserver. Hence it'll need to know which CN's to accept. I.e. a request to an extension server would go:
client request -> kube-apiserver -> extension-apiserver
The extension apiserver would then also check the CN once it received the request after it was routed there by main kube-apiserver.
answered 2 days ago
Fred ClausenFred Clausen
1,3461620
add a comment |
I think I understand now why the main kube-apiserver needs this allowed names list: The kube-apiserver is a frontend for all the extension apiservers. So the requests always go through kube-apiserver first; it aggregates the requests and then passes them onto the correct backend extension apiserver. Hence it'll need to know which CN's to accept. I.e. a request to an extension server would go:
client request -> kube-apiserver -> extension-apiserver
The extension apiserver would then also check the CN once it received the request after it was routed there by main kube-apiserver.
answered 2 days ago
Fred ClausenFred Clausen
1,3461620
add a comment |
I think I understand now why the main kube-apiserver needs this allowed names list: The kube-apiserver is a frontend for all the extension apiservers. So the requests always go through kube-apiserver first; it aggregates the requests and then passes them onto the correct backend extension apiserver. Hence it'll need to know which CN's to accept. I.e. a request to an extension server would go:
client request -> kube-apiserver -> extension-apiserver
The extension apiserver would then also check the CN once it received the request after it was routed there by main kube-apiserver.
answered 2 days ago
Fred ClausenFred Clausen
1,3461620
I think I understand now why the main kube-apiserver needs this allowed names list: The kube-apiserver is a frontend for all the extension apiservers. So the requests always go through kube-apiserver first; it aggregates the requests and then passes them onto the correct backend extension apiserver. Hence it'll need to know which CN's to accept. I.e. a request to an extension server would go:
client request -> kube-apiserver -> extension-apiserver
The extension apiserver would then also check the CN once it received the request after it was routed there by main kube-apiserver.
answered 2 days ago
Fred ClausenFred Clausen
1,3461620
answered 2 days ago
Fred ClausenFred Clausen
1,3461620
answered 2 days ago
Fred ClausenFred Clausen
1,3461620
answered 2 days ago
Fred ClausenFred Clausen
1,3461620
1,3461620
add a comment |
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f966122%2fkubernetes-aggregation-certificates-apiserver-client-authentication-allowed-na%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
