{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/11000","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/11000/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/11000/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/11000/events","html_url":"https://github.com/kubernetes/kubernetes/issues/11000","id":94101034,"number":11000,"title":"Improve documentation on how authentication is handled in Kubernetes","user":{"login":"devurandom","id":63082,"avatar_url":"https://avatars.githubusercontent.com/u/63082?v=3","gravatar_id":"","url":"https://api.github.com/users/devurandom","html_url":"https://github.com/devurandom","followers_url":"https://api.github.com/users/devurandom/followers","following_url":"https://api.github.com/users/devurandom/following{/other_user}","gists_url":"https://api.github.com/users/devurandom/gists{/gist_id}","starred_url":"https://api.github.com/users/devurandom/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/devurandom/subscriptions","organizations_url":"https://api.github.com/users/devurandom/orgs","repos_url":"https://api.github.com/users/devurandom/repos","events_url":"https://api.github.com/users/devurandom/events{/privacy}","received_events_url":"https://api.github.com/users/devurandom/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/area/auth","name":"area/auth","color":"00cc00"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/documentation","name":"kind/documentation","color":"c7def8"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/priority/P1","name":"priority/P1","color":"eb6420"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/control-plane","name":"team/control-plane","color":"d2b48c"},{"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/CSI-API%20Machinery%20SIG","name":"team/CSI-API Machinery SIG","color":"d2b48c"}],"state":"open","locked":false,"assignee":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"assignees":[{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false}],"milestone":null,"comments":26,"created_at":"2015-07-09T16:57:20Z","updated_at":"2016-07-13T20:52:08Z","closed_at":null,"body":"This is a follow up from https://github.com/GoogleCloudPlatform/kubernetes/issues/10265#issuecomment-118595068\r\n\r\nThere I was asking about documentation on serviceaccounts and certificates. I have already read http://docs.k8s.io/design/service_accounts.md (and a few others), but still there are lots of questions:\r\n\r\n* Is the CA certificate in `--root-ca-file=` authenticated by the key in `--service-account-key-file=`?\r\n* If so, I cannot create the `--service-account-key-file=` on the host automatically via a systemd.service unit, unless I also automatically create the `--root-ca-file=` via a systemd.service, correct?\r\n* Is the missing `ca.crt` secret in my default serviceaccount the same as the one I would hand to the kube-controller-manager via `--root-ca-file=`?\r\n* Will I have to distribute these files to the client I run kubectl on?\r\n* Will the kube-controller-manager and/or the kubelets automatically create certificates for themselves signed by `--root-ca-file=`?\r\n* If so, how do I control which host is allowed to get such a certificate, and which will not be allowed to join the cluster?\r\n* How is the certificate for connection with a client kubectl created? Do I need to also automatically create a client certificate using a systemd.service and then fetch the file using e.g. ssh?\r\n* If so, I assume the automatic generation of the key as laid out in the examples is not actually recommended, as it is utterly cumbersome?\r\n* I read that on GCE you use Salt to distribute the (manually created) root certificates. Is there any convenient way to do this on a bare-metal CoreOS cluster? Writing a properly indented `write_files` directive for `cloud-config` appears unflexible and cumbersome on its own.\r\n* Is all authentication between the Kubernetes master (kube-apiserver, kube-controller-manager, kube-scheduler) and the kubelets and kubectls handled via HTTPS and client certificates?\r\n\r\nThe following question was already answered by @satnam6502 in https://github.com/GoogleCloudPlatform/kubernetes/issues/10265#issuecomment-118595167, but I mention it here for completeness (in case someone wants to write down docs or a FAQ):\r\n\r\n* What is the `token` of the serviceaccount being used for?\r\n\r\n> One of the uses of the token is to make it more convenient to issue things like curl commands to the API server or application endpoints (e.g. Elasticsearch and KIbana logging endpoints). See https://github.com/GoogleCloudPlatform/kubernetes/blob/master/docs/getting-started-guides/logging-elasticsearch.md"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/232482896","html_url":"https://github.com/kubernetes/kubernetes/issues/11000#issuecomment-232482896","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/11000","id":232482896,"user":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"created_at":"2016-07-13T20:52:08Z","updated_at":"2016-07-13T20:52:08Z","body":"What you said makes sense.  I hope your head feels better!"}}
{"actor":{"display_login":"erictune"}}