{"action":"created","comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/comments/79265387","id":79265387,"diff_hunk":"@@ -83,3 +83,57 @@ cluster (connecting to the ssh server listening on port 22) and passes all\n traffic destined for a kubelet, node, pod, or service through the tunnel.\n This tunnel ensures that the traffic is not exposed outside of the private\n GCE network in which the cluster is running.\n+\n+### Kubelet TLS Bootstrap \n+\n+The 1.4 release introduces an experimental API for requesting certificates from a cluster-level CA. The first supported use of this API is the provisioning of TLS client certificates for kubelets. The proposal can be found [here] and progress on the feature is being tracked as [feature #43](https://github.com/kubernetes/features/issues/43). \n+\n+Workflow \n+\n+##### apiserver configuration\n+A token file specifies at least one token as a \"bootstrap token\" assigned to a kubelet boostrap-specific group. This group will later be used in the controller-manager configuration to scope approvals in the default approval controller. As this feature matures, this token should also be bound to an RBAC policy that limits requests using the bootstrap token to only be able to make requests related to certificate provisioning. When RBAC policy is in place, scoping the tokens to a group will allow great flexibility (e.g. you could disable a particular bootstrap group's access when you are done provisioning the nodes). \n+\n+##### Token auth file \n+Tokens are arbitrary, but should represent at least 128 bits of entropy derived from a secure random number generator (such as /dev/urandom on most modern systems). There are lots of ways you could generate tokens; one is: \n+\n+`head -c 16 /dev/urandom | od -An -t x | tr -d ' '` \n+\n+which will generate tokens that look like `02b50b05283e98dd0fd71db496ef01e8` \n+\n+The token file will look like this, where the first three values can be anything and the quoted group name should be as depicted: ","path":"docs/admin/master-node-communication.md","position":21,"original_position":21,"commit_id":"8da228ef5a024644a8526f2ff69d244badac6ec8","original_commit_id":"8da228ef5a024644a8526f2ff69d244badac6ec8","user":{"login":"devin-donnelly","id":18451904,"avatar_url":"https://avatars.githubusercontent.com/u/18451904?v=3","gravatar_id":"","url":"https://api.github.com/users/devin-donnelly","html_url":"https://github.com/devin-donnelly","followers_url":"https://api.github.com/users/devin-donnelly/followers","following_url":"https://api.github.com/users/devin-donnelly/following{/other_user}","gists_url":"https://api.github.com/users/devin-donnelly/gists{/gist_id}","starred_url":"https://api.github.com/users/devin-donnelly/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/devin-donnelly/subscriptions","organizations_url":"https://api.github.com/users/devin-donnelly/orgs","repos_url":"https://api.github.com/users/devin-donnelly/repos","events_url":"https://api.github.com/users/devin-donnelly/events{/privacy}","received_events_url":"https://api.github.com/users/devin-donnelly/received_events","type":"User","site_admin":false},"body":"\"The token file will look like the following example, where...\"","created_at":"2016-09-16T23:09:04Z","updated_at":"2016-09-16T23:09:04Z","html_url":"https://github.com/kubernetes/kubernetes.github.io/pull/1246#discussion_r79265387","pull_request_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/1246","_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/comments/79265387"},"html":{"href":"https://github.com/kubernetes/kubernetes.github.io/pull/1246#discussion_r79265387"},"pull_request":{"href":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/1246"}}},"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/1246","id":85620905,"html_url":"https://github.com/kubernetes/kubernetes.github.io/pull/1246","diff_url":"https://github.com/kubernetes/kubernetes.github.io/pull/1246.diff","patch_url":"https://github.com/kubernetes/kubernetes.github.io/pull/1246.patch","issue_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/issues/1246","number":1246,"state":"open","locked":false,"title":"Adds documentation for TLS bootstrapping","user":{"login":"calebamiles","id":848394,"avatar_url":"https://avatars.githubusercontent.com/u/848394?v=3","gravatar_id":"","url":"https://api.github.com/users/calebamiles","html_url":"https://github.com/calebamiles","followers_url":"https://api.github.com/users/calebamiles/followers","following_url":"https://api.github.com/users/calebamiles/following{/other_user}","gists_url":"https://api.github.com/users/calebamiles/gists{/gist_id}","starred_url":"https://api.github.com/users/calebamiles/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/calebamiles/subscriptions","organizations_url":"https://api.github.com/users/calebamiles/orgs","repos_url":"https://api.github.com/users/calebamiles/repos","events_url":"https://api.github.com/users/calebamiles/events{/privacy}","received_events_url":"https://api.github.com/users/calebamiles/received_events","type":"User","site_admin":false},"body":"Documents workflow for using experimental kublet TLS bootstrapping enabled by https://github.com/kubernetes/features/issues/43\n\n<!-- Reviewable:start -->\n---\nThis change is [<img src=\"https://reviewable.kubernetes.io/review_button.svg\" height=\"34\" align=\"absmiddle\" alt=\"Reviewable\"/>](https://reviewable.kubernetes.io/reviews/kubernetes/kubernetes.github.io/1246)\n<!-- Reviewable:end -->\n","created_at":"2016-09-16T18:45:02Z","updated_at":"2016-09-16T23:12:19Z","closed_at":null,"merged_at":null,"merge_commit_sha":"e246fac22c47d4ced1837ff4310ac27d05c5dd06","assignee":{"login":"devin-donnelly","id":18451904,"avatar_url":"https://avatars.githubusercontent.com/u/18451904?v=3","gravatar_id":"","url":"https://api.github.com/users/devin-donnelly","html_url":"https://github.com/devin-donnelly","followers_url":"https://api.github.com/users/devin-donnelly/followers","following_url":"https://api.github.com/users/devin-donnelly/following{/other_user}","gists_url":"https://api.github.com/users/devin-donnelly/gists{/gist_id}","starred_url":"https://api.github.com/users/devin-donnelly/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/devin-donnelly/subscriptions","organizations_url":"https://api.github.com/users/devin-donnelly/orgs","repos_url":"https://api.github.com/users/devin-donnelly/repos","events_url":"https://api.github.com/users/devin-donnelly/events{/privacy}","received_events_url":"https://api.github.com/users/devin-donnelly/received_events","type":"User","site_admin":false},"assignees":[{"login":"devin-donnelly","id":18451904,"avatar_url":"https://avatars.githubusercontent.com/u/18451904?v=3","gravatar_id":"","url":"https://api.github.com/users/devin-donnelly","html_url":"https://github.com/devin-donnelly","followers_url":"https://api.github.com/users/devin-donnelly/followers","following_url":"https://api.github.com/users/devin-donnelly/following{/other_user}","gists_url":"https://api.github.com/users/devin-donnelly/gists{/gist_id}","starred_url":"https://api.github.com/users/devin-donnelly/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/devin-donnelly/subscriptions","organizations_url":"https://api.github.com/users/devin-donnelly/orgs","repos_url":"https://api.github.com/users/devin-donnelly/repos","events_url":"https://api.github.com/users/devin-donnelly/events{/privacy}","received_events_url":"https://api.github.com/users/devin-donnelly/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/milestones/3","html_url":"https://github.com/kubernetes/kubernetes.github.io/milestones/1.4","labels_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/milestones/3/labels","id":1976241,"number":3,"title":"1.4","description":null,"creator":{"login":"devin-donnelly","id":18451904,"avatar_url":"https://avatars.githubusercontent.com/u/18451904?v=3","gravatar_id":"","url":"https://api.github.com/users/devin-donnelly","html_url":"https://github.com/devin-donnelly","followers_url":"https://api.github.com/users/devin-donnelly/followers","following_url":"https://api.github.com/users/devin-donnelly/following{/other_user}","gists_url":"https://api.github.com/users/devin-donnelly/gists{/gist_id}","starred_url":"https://api.github.com/users/devin-donnelly/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/devin-donnelly/subscriptions","organizations_url":"https://api.github.com/users/devin-donnelly/orgs","repos_url":"https://api.github.com/users/devin-donnelly/repos","events_url":"https://api.github.com/users/devin-donnelly/events{/privacy}","received_events_url":"https://api.github.com/users/devin-donnelly/received_events","type":"User","site_admin":false},"open_issues":13,"closed_issues":28,"state":"open","created_at":"2016-08-31T22:19:36Z","updated_at":"2016-09-16T18:48:17Z","due_on":null,"closed_at":null},"commits_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/1246/commits","review_comments_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/1246/comments","review_comment_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/comments{/number}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/issues/1246/comments","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/statuses/8da228ef5a024644a8526f2ff69d244badac6ec8","head":{"label":"calebamiles:release-1.4","ref":"release-1.4","sha":"8da228ef5a024644a8526f2ff69d244badac6ec8","user":{"login":"calebamiles","id":848394,"avatar_url":"https://avatars.githubusercontent.com/u/848394?v=3","gravatar_id":"","url":"https://api.github.com/users/calebamiles","html_url":"https://github.com/calebamiles","followers_url":"https://api.github.com/users/calebamiles/followers","following_url":"https://api.github.com/users/calebamiles/following{/other_user}","gists_url":"https://api.github.com/users/calebamiles/gists{/gist_id}","starred_url":"https://api.github.com/users/calebamiles/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/calebamiles/subscriptions","organizations_url":"https://api.github.com/users/calebamiles/orgs","repos_url":"https://api.github.com/users/calebamiles/repos","events_url":"https://api.github.com/users/calebamiles/events{/privacy}","received_events_url":"https://api.github.com/users/calebamiles/received_events","type":"User","site_admin":false},"repo":{"id":68405501,"name":"kubernetes.github.io","full_name":"calebamiles/kubernetes.github.io","owner":{"login":"calebamiles","id":848394,"avatar_url":"https://avatars.githubusercontent.com/u/848394?v=3","gravatar_id":"","url":"https://api.github.com/users/calebamiles","html_url":"https://github.com/calebamiles","followers_url":"https://api.github.com/users/calebamiles/followers","following_url":"https://api.github.com/users/calebamiles/following{/other_user}","gists_url":"https://api.github.com/users/calebamiles/gists{/gist_id}","starred_url":"https://api.github.com/users/calebamiles/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/calebamiles/subscriptions","organizations_url":"https://api.github.com/users/calebamiles/orgs","repos_url":"https://api.github.com/users/calebamiles/repos","events_url":"https://api.github.com/users/calebamiles/events{/privacy}","received_events_url":"https://api.github.com/users/calebamiles/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/calebamiles/kubernetes.github.io","description":"Website/documentation repo","fork":true,"url":"https://api.github.com/repos/calebamiles/kubernetes.github.io","forks_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/forks","keys_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/keys{/key_id}","collaborators_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/teams","hooks_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/hooks","issue_events_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/issues/events{/number}","events_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/events","assignees_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/assignees{/user}","branches_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/branches{/branch}","tags_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/tags","blobs_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/git/refs{/sha}","trees_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/git/trees{/sha}","statuses_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/statuses/{sha}","languages_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/languages","stargazers_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/stargazers","contributors_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/contributors","subscribers_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/subscribers","subscription_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/subscription","commits_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/commits{/sha}","git_commits_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/git/commits{/sha}","comments_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/comments{/number}","issue_comment_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/issues/comments{/number}","contents_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/contents/{+path}","compare_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/compare/{base}...{head}","merges_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/merges","archive_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/downloads","issues_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/issues{/number}","pulls_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/pulls{/number}","milestones_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/milestones{/number}","notifications_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/labels{/name}","releases_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/releases{/id}","deployments_url":"https://api.github.com/repos/calebamiles/kubernetes.github.io/deployments","created_at":"2016-09-16T18:34:35Z","updated_at":"2016-09-16T18:34:37Z","pushed_at":"2016-09-16T18:44:26Z","git_url":"git://github.com/calebamiles/kubernetes.github.io.git","ssh_url":"git@github.com:calebamiles/kubernetes.github.io.git","clone_url":"https://github.com/calebamiles/kubernetes.github.io.git","svn_url":"https://github.com/calebamiles/kubernetes.github.io","homepage":null,"size":38413,"stargazers_count":0,"watchers_count":0,"language":"HTML","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"kubernetes:release-1.4","ref":"release-1.4","sha":"56de4ad1e5ab5eb807e7bc9c94ac6483533398b2","user":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"repo":{"id":51478266,"name":"kubernetes.github.io","full_name":"kubernetes/kubernetes.github.io","owner":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/kubernetes/kubernetes.github.io","description":"Website/documentation repo","fork":false,"url":"https://api.github.com/repos/kubernetes/kubernetes.github.io","forks_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/forks","keys_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/teams","hooks_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/hooks","issue_events_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/issues/events{/number}","events_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/events","assignees_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/assignees{/user}","branches_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/branches{/branch}","tags_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/tags","blobs_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/git/refs{/sha}","trees_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/statuses/{sha}","languages_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/languages","stargazers_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/stargazers","contributors_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/contributors","subscribers_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/subscribers","subscription_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/subscription","commits_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/commits{/sha}","git_commits_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/git/commits{/sha}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/comments{/number}","issue_comment_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/issues/comments{/number}","contents_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/contents/{+path}","compare_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/merges","archive_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/downloads","issues_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/issues{/number}","pulls_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls{/number}","milestones_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/milestones{/number}","notifications_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/labels{/name}","releases_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/releases{/id}","deployments_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/deployments","created_at":"2016-02-10T22:46:48Z","updated_at":"2016-09-16T19:35:53Z","pushed_at":"2016-09-16T23:05:41Z","git_url":"git://github.com/kubernetes/kubernetes.github.io.git","ssh_url":"git@github.com:kubernetes/kubernetes.github.io.git","clone_url":"https://github.com/kubernetes/kubernetes.github.io.git","svn_url":"https://github.com/kubernetes/kubernetes.github.io","homepage":null,"size":47677,"stargazers_count":68,"watchers_count":68,"language":"HTML","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":471,"mirror_url":null,"open_issues_count":375,"forks":471,"open_issues":375,"watchers":68,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/1246"},"html":{"href":"https://github.com/kubernetes/kubernetes.github.io/pull/1246"},"issue":{"href":"https://api.github.com/repos/kubernetes/kubernetes.github.io/issues/1246"},"comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes.github.io/issues/1246/comments"},"review_comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/1246/comments"},"review_comment":{"href":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/1246/commits"},"statuses":{"href":"https://api.github.com/repos/kubernetes/kubernetes.github.io/statuses/8da228ef5a024644a8526f2ff69d244badac6ec8"}}}}
{"actor":{"display_login":"devin-donnelly"}}