{"action":"created","comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/comments/61972319","id":61972319,"diff_hunk":"@@ -1,72 +1,149 @@\n ---\n ---\n \n-This document describes what ports the Kubernetes apiserver\n-may serve on and how to reach them.  The audience is\n-cluster administrators who want to customize their cluster\n-or understand the details.\n+This document describes how access to the Kubernetes API is controlled.\n \n-Most questions about accessing the cluster are covered\n-in [Accessing the cluster](/docs/user-guide/accessing-the-cluster).\n+# Overview\n \n+Users [access the API](/docs/user-guide/accessing-the-cluster) using `kubectl`,\n+client libraries, or by making REST requests.  Users include human users and\n+[Kubernetes Service Accounts](http://kubernetes.io/docs/user-guide/service-accounts/).\n+When a request reaches the API, it goes through several stages, illustrated in the\n+following diagram:\n \n-## Ports and IPs Served On\n+<img src=\"/images/docs/admin/accessing-the-api.svg\">\n \n-The Kubernetes API is served by the Kubernetes apiserver process.  Typically,\n-there is one of these running on a single kubernetes-master node.\n+# Transport Security\n+\n+In a typical kubernetes cluster, the API served on port 443.  A TLS connection is\n+established.  The API server presents a certificate.  This certificate is\n+often self-signed, so `$USER/.kube/config` on the user's machine typically\n+contains the root certficate for the API server's certificate, which when specified\n+is used in place of the system default root certificates.  This certificate is typically\n+automatically written into your `$USER/.kube/config` when you create a cluster yourself\n+using `kube-up.sh`.  If the cluster has multiple users, then the creator needs to share\n+the certificate with other users.\n+\n+# Authentication\n+\n+Once TLS is established, the HTTP request moves to the Authentication step.\n+This is shown as step **1** in the diagram.\n+The cluster creation script or cluster admin configures the API server to run\n+one or more Authenticator Modules.\n+Authenticators are described in more detail [here](/docs/admin/authentication/).\n+\n+The input to the authentication step is the entire HTTP request, however, it typically\n+just examines the headers and/or or client certificate.\n+\n+Authentication modules include Client Certificates, Password, and Plain Tokens,\n+and JWT Tokens (used for service accounts).\n+\n+Multiple authentication modules can be specified, in which case each one is tried in sequence,\n+until one of them succeeds.\n+\n+On GCE, Client Certificates, Password, Plain Tokens, and JWT Tokens are all enabled.\n+\n+If the request cannot be authenticated, it is rejected with HTTP status code 401.\n+Otherwise, the user is authenticated as a specific `username`, and tht user name","path":"docs/admin/accessing-the-api.md","position":56,"original_position":56,"commit_id":"0caf774c9d28ea3b1bf1bea419a9551bc13fc2c1","original_commit_id":"0caf774c9d28ea3b1bf1bea419a9551bc13fc2c1","user":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"body":"fixed","created_at":"2016-05-03T23:16:22Z","updated_at":"2016-05-03T23:16:22Z","html_url":"https://github.com/kubernetes/kubernetes.github.io/pull/460#discussion_r61972319","pull_request_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/460","_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/comments/61972319"},"html":{"href":"https://github.com/kubernetes/kubernetes.github.io/pull/460#discussion_r61972319"},"pull_request":{"href":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/460"}}},"pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/460","id":68643237,"html_url":"https://github.com/kubernetes/kubernetes.github.io/pull/460","diff_url":"https://github.com/kubernetes/kubernetes.github.io/pull/460.diff","patch_url":"https://github.com/kubernetes/kubernetes.github.io/pull/460.patch","issue_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/issues/460","number":460,"state":"open","locked":false,"title":"Improve Auth/Admission documentation","user":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"body":"","created_at":"2016-05-03T00:30:16Z","updated_at":"2016-05-03T23:16:22Z","closed_at":null,"merged_at":null,"merge_commit_sha":"d8936321554a98d4ee2c0de463e5c36f12b42d76","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/460/commits","review_comments_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/460/comments","review_comment_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/comments{/number}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/issues/460/comments","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/statuses/0caf774c9d28ea3b1bf1bea419a9551bc13fc2c1","head":{"label":"erictune:authadm","ref":"authadm","sha":"0caf774c9d28ea3b1bf1bea419a9551bc13fc2c1","user":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"repo":{"id":54070650,"name":"erictune.github.io","full_name":"erictune/erictune.github.io","owner":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/erictune/erictune.github.io","description":"Website/documentation repo","fork":true,"url":"https://api.github.com/repos/erictune/erictune.github.io","forks_url":"https://api.github.com/repos/erictune/erictune.github.io/forks","keys_url":"https://api.github.com/repos/erictune/erictune.github.io/keys{/key_id}","collaborators_url":"https://api.github.com/repos/erictune/erictune.github.io/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/erictune/erictune.github.io/teams","hooks_url":"https://api.github.com/repos/erictune/erictune.github.io/hooks","issue_events_url":"https://api.github.com/repos/erictune/erictune.github.io/issues/events{/number}","events_url":"https://api.github.com/repos/erictune/erictune.github.io/events","assignees_url":"https://api.github.com/repos/erictune/erictune.github.io/assignees{/user}","branches_url":"https://api.github.com/repos/erictune/erictune.github.io/branches{/branch}","tags_url":"https://api.github.com/repos/erictune/erictune.github.io/tags","blobs_url":"https://api.github.com/repos/erictune/erictune.github.io/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/erictune/erictune.github.io/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/erictune/erictune.github.io/git/refs{/sha}","trees_url":"https://api.github.com/repos/erictune/erictune.github.io/git/trees{/sha}","statuses_url":"https://api.github.com/repos/erictune/erictune.github.io/statuses/{sha}","languages_url":"https://api.github.com/repos/erictune/erictune.github.io/languages","stargazers_url":"https://api.github.com/repos/erictune/erictune.github.io/stargazers","contributors_url":"https://api.github.com/repos/erictune/erictune.github.io/contributors","subscribers_url":"https://api.github.com/repos/erictune/erictune.github.io/subscribers","subscription_url":"https://api.github.com/repos/erictune/erictune.github.io/subscription","commits_url":"https://api.github.com/repos/erictune/erictune.github.io/commits{/sha}","git_commits_url":"https://api.github.com/repos/erictune/erictune.github.io/git/commits{/sha}","comments_url":"https://api.github.com/repos/erictune/erictune.github.io/comments{/number}","issue_comment_url":"https://api.github.com/repos/erictune/erictune.github.io/issues/comments{/number}","contents_url":"https://api.github.com/repos/erictune/erictune.github.io/contents/{+path}","compare_url":"https://api.github.com/repos/erictune/erictune.github.io/compare/{base}...{head}","merges_url":"https://api.github.com/repos/erictune/erictune.github.io/merges","archive_url":"https://api.github.com/repos/erictune/erictune.github.io/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/erictune/erictune.github.io/downloads","issues_url":"https://api.github.com/repos/erictune/erictune.github.io/issues{/number}","pulls_url":"https://api.github.com/repos/erictune/erictune.github.io/pulls{/number}","milestones_url":"https://api.github.com/repos/erictune/erictune.github.io/milestones{/number}","notifications_url":"https://api.github.com/repos/erictune/erictune.github.io/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/erictune/erictune.github.io/labels{/name}","releases_url":"https://api.github.com/repos/erictune/erictune.github.io/releases{/id}","deployments_url":"https://api.github.com/repos/erictune/erictune.github.io/deployments","created_at":"2016-03-16T22:23:00Z","updated_at":"2016-03-16T22:24:35Z","pushed_at":"2016-05-03T13:09:08Z","git_url":"git://github.com/erictune/erictune.github.io.git","ssh_url":"git@github.com:erictune/erictune.github.io.git","clone_url":"https://github.com/erictune/erictune.github.io.git","svn_url":"https://github.com/erictune/erictune.github.io","homepage":null,"size":33184,"stargazers_count":0,"watchers_count":0,"language":"HTML","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"kubernetes:master","ref":"master","sha":"4e5da5d0e57b4460eede103ca8269ae05c4eb16f","user":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"repo":{"id":51478266,"name":"kubernetes.github.io","full_name":"kubernetes/kubernetes.github.io","owner":{"login":"kubernetes","id":13629408,"avatar_url":"https://avatars.githubusercontent.com/u/13629408?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes","html_url":"https://github.com/kubernetes","followers_url":"https://api.github.com/users/kubernetes/followers","following_url":"https://api.github.com/users/kubernetes/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes/subscriptions","organizations_url":"https://api.github.com/users/kubernetes/orgs","repos_url":"https://api.github.com/users/kubernetes/repos","events_url":"https://api.github.com/users/kubernetes/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/kubernetes/kubernetes.github.io","description":"Website/documentation repo","fork":false,"url":"https://api.github.com/repos/kubernetes/kubernetes.github.io","forks_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/forks","keys_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/teams","hooks_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/hooks","issue_events_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/issues/events{/number}","events_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/events","assignees_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/assignees{/user}","branches_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/branches{/branch}","tags_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/tags","blobs_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/git/refs{/sha}","trees_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/statuses/{sha}","languages_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/languages","stargazers_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/stargazers","contributors_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/contributors","subscribers_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/subscribers","subscription_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/subscription","commits_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/commits{/sha}","git_commits_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/git/commits{/sha}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/comments{/number}","issue_comment_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/issues/comments{/number}","contents_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/contents/{+path}","compare_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/merges","archive_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/downloads","issues_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/issues{/number}","pulls_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls{/number}","milestones_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/milestones{/number}","notifications_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/labels{/name}","releases_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/releases{/id}","deployments_url":"https://api.github.com/repos/kubernetes/kubernetes.github.io/deployments","created_at":"2016-02-10T22:46:48Z","updated_at":"2016-04-29T11:59:34Z","pushed_at":"2016-05-03T20:47:04Z","git_url":"git://github.com/kubernetes/kubernetes.github.io.git","ssh_url":"git@github.com:kubernetes/kubernetes.github.io.git","clone_url":"https://github.com/kubernetes/kubernetes.github.io.git","svn_url":"https://github.com/kubernetes/kubernetes.github.io","homepage":null,"size":33399,"stargazers_count":45,"watchers_count":45,"language":"HTML","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":190,"mirror_url":null,"open_issues_count":166,"forks":190,"open_issues":166,"watchers":45,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/460"},"html":{"href":"https://github.com/kubernetes/kubernetes.github.io/pull/460"},"issue":{"href":"https://api.github.com/repos/kubernetes/kubernetes.github.io/issues/460"},"comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes.github.io/issues/460/comments"},"review_comments":{"href":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/460/comments"},"review_comment":{"href":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/kubernetes/kubernetes.github.io/pulls/460/commits"},"statuses":{"href":"https://api.github.com/repos/kubernetes/kubernetes.github.io/statuses/0caf774c9d28ea3b1bf1bea419a9551bc13fc2c1"}}}}