External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-02-22 13:36:06 -03:30
Code Issues Packages Projects Releases Wiki Activity

Security best practice fixes (#1783)

Browse Source 
* Disable basic and token auth by default

* Add recommended security params

* allow basic auth to fail in tests

* Enable TLS authentication for kubelet
This commit is contained in:
Matthew Mosesohn
2017-10-15 20:41:17 +01:00
committed by GitHub
parent 66e5e14bac
commit d487b2f927
9 changed files with 23 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
roles/kubernetes/node/templates/kubelet.standard.env.j2
View File

@@ -14,6 +14,9 @@ KUBELET_HOSTNAME="--hostname-override={{ kube_override_hostname }}"
--pod-infra-container-image={{ pod_infra_image_repo }}:{{ pod_infra_image_tag }} \
--node-status-update-frequency={{ kubelet_status_update_frequency }} \
--docker-disable-shared-pid={{ kubelet_disable_shared_pid }} \
--client-ca-file={{ kube_cert_dir }}/ca.pem \
--tls-cert-file={{ kube_cert_dir }}/node-{{ inventory_hostname }}.pem \
--tls-private-key-file={{ kube_cert_dir }}/node-{{ inventory_hostname }}-key.pem \
{% if kube_version | version_compare('v1.6', '>=') %}
{# flag got removed with 1.7.0 #}
{% if kube_version | version_compare('v1.7', '<') %}