You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/en/docs/concepts/extend-kubernetes/api-extension/apiserver-aggregation.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -49,8 +49,8 @@ let you meet it.
49
49
* To get the aggregator working in your environment, [configure the aggregation layer](/docs/tasks/extend-kubernetes/configure-aggregation-layer/).
50
50
* Then, [setup an extension api-server](/docs/tasks/extend-kubernetes/setup-extension-api-server/) to work with the aggregation layer.
51
51
* Read about [APIService](/docs/reference/kubernetes-api/cluster-resources/api-service-v1/) in the API reference
52
-
* Learn about [Declarative Validation Concepts](/docs/reference/using-api/declarative-validation.md), an internal mechanism for defining validation rules that in the future will help support validation for extension API server development.
53
-
54
-
Alternatively: learn how to
55
-
[extend the Kubernetes API using Custom Resource Definitions](/docs/tasks/extend-kubernetes/custom-resources/custom-resource-definitions/).
52
+
* Learn about [Declarative Validation Concepts](/docs/reference/using-api/declarative-validation/),
53
+
an internal mechanism for defining validation rules that in the future will help support validation for extension API server development.
56
54
55
+
Alternatively: learn how to extend the Kubernetes API using
Copy file name to clipboardExpand all lines: content/en/docs/concepts/security/hardening-guide/scheduler.md
+37-21Lines changed: 37 additions & 21 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -22,43 +22,58 @@ This can aid an attacker with a [Yo-Yo attack](https://arxiv.org/abs/2105.00542)
22
22
23
23
### Scheduler authentication & authorization command line options
24
24
25
-
When setting up authentication configuration, it should be made sure that kube-scheduler's authentication remains consistent with kube-api-server's authentication.
26
-
If any request has missing authentication headers,
27
-
the [authentication should happen through the kube-api-server allowing all authentication to be consistent in the cluster](/docs/tasks/extend-kubernetes/configure-aggregation-layer/#original-request-username-and-group).
28
-
29
-
-`authentication-kubeconfig`: Make sure to provide a proper kubeconfig so that the scheduler can retrieve authentication configuration options from the API Server. This kubeconfig file should be protected with strict file permissions.
30
-
-`authentication-tolerate-lookup-failure`: Set this to `false` to make sure the scheduler _always_ looks up its authentication configuration from the API server.
31
-
-`authentication-skip-lookup`: Set this to `false` to make sure the scheduler _always_ looks up its authentication configuration from the API server.
32
-
-`authorization-always-allow-paths`: These paths should respond with data that is appropriate for anonymous authorization. Defaults to `/healthz,/readyz,/livez`.
33
-
-`profiling`: Set to `false` to disable the profiling endpoints which are provide debugging information but which should not be enabled on production clusters as they present a risk of denial of service or information leakage. The `--profiling` argument is deprecated and can now be provided through the [KubeScheduler DebuggingConfiguration](https://kubernetes.io/docs/reference/config-api/kube-scheduler-config.v1/#DebuggingConfiguration). Profiling can be disabled through the kube-scheduler config by setting `enableProfiling` to `false`.
25
+
When setting up authentication configuration, it should be made sure that
26
+
kube-scheduler's authentication remains consistent with kube-api-server's authentication.
27
+
If any request has missing authentication headers, the authentication should happen through the kube-api-server
28
+
[allowing all authentication to be consistent in the cluster](/docs/tasks/extend-kubernetes/configure-aggregation-layer/#original-request-username-and-group).
29
+
30
+
-`authentication-kubeconfig`: Make sure to provide a proper kubeconfig so that
31
+
the scheduler can retrieve authentication configuration options from the API Server.
32
+
This kubeconfig file should be protected with strict file permissions.
33
+
-`authentication-tolerate-lookup-failure`: Set this to `false` to make sure
34
+
the scheduler _always_ looks up its authentication configuration from the API server.
35
+
-`authentication-skip-lookup`: Set this to `false` to make sure
36
+
the scheduler _always_ looks up its authentication configuration from the API server.
37
+
-`authorization-always-allow-paths`: These paths should respond with data that is appropriate
38
+
for anonymous authorization. Defaults to `/healthz,/readyz,/livez`.
39
+
-`profiling`: Set to `false` to disable the profiling endpoints which are provide debugging information
40
+
but which should not be enabled on production clusters as they present a risk of denial of service
41
+
or information leakage. The `--profiling` argument is deprecated and can now be provided through the
Profiling can be disabled through the kube-scheduler config by setting `enableProfiling` to `false`.
34
44
-`requestheader-client-ca-file`: Avoid passing this argument.
35
45
36
-
37
46
### Scheduler networking command line options
38
47
39
-
-`bind-address`: In most cases, the kube-scheduler does not need to be externally accessible. Setting the bind address to `localhost` is a secure practice.
40
-
-`permit-address-sharing`: Set this to `false` to disable connection sharing through `SO_REUSEADDR`. `SO_REUSEADDR` can lead to reuse of terminated connections that are in `TIME_WAIT` state.
48
+
-`bind-address`: In most cases, the kube-scheduler does not need to be externally accessible.
49
+
Setting the bind address to `localhost` is a secure practice.
50
+
-`permit-address-sharing`: Set this to `false` to disable connection sharing through `SO_REUSEADDR`.
51
+
`SO_REUSEADDR` can lead to reuse of terminated connections that are in `TIME_WAIT` state.
41
52
-`permit-port-sharing`: Default `false`. Use the default unless you are confident you understand the security implications.
42
53
43
-
44
54
### Scheduler TLS command line options
45
55
46
-
-`tls-cipher-suites`: Always provide a list of preferred cipher suites. This ensures encryption never happens with insecure cipher suites.
47
-
56
+
-`tls-cipher-suites`: Always provide a list of preferred cipher suites.
57
+
This ensures encryption never happens with insecure cipher suites.
48
58
49
59
## Scheduling configurations for custom schedulers
50
60
51
61
When using custom schedulers based on the Kubernetes scheduling code, cluster administrators need to be careful with
52
62
plugins that use the `queueSort`, `prefilter`, `filter`, or `permit`[extension points](/docs/reference/scheduling/config/#extension-points).
53
-
These extension points control various stages of a scheduling process, and the wrong configuration can impact the kube-scheduler's behavior in your cluster.
63
+
These extension points control various stages of a scheduling process,
64
+
and the wrong configuration can impact the kube-scheduler's behavior in your cluster.
54
65
55
66
### Key considerations
56
67
57
-
- Exactly one plugin that uses the `queueSort` extension point can be enabled at a time. Any plugins that use `queueSort` should be scrutinized.
58
-
- Plugins that implement the `prefilter` or `filter` extension point can potentially mark all nodes as unschedulable. This can bring scheduling of new pods to a halt.
59
-
- Plugins that implement the `permit` extension point can prevent or delay the binding of a Pod. Such plugins should be thoroughly reviewed by the cluster administrator.
68
+
- Exactly one plugin that uses the `queueSort` extension point can be enabled at a time.
69
+
Any plugins that use `queueSort` should be scrutinized.
70
+
- Plugins that implement the `prefilter` or `filter` extension point can potentially mark all nodes as unschedulable.
71
+
This can bring scheduling of new pods to a halt.
72
+
- Plugins that implement the `permit` extension point can prevent or delay the binding of a Pod.
73
+
Such plugins should be thoroughly reviewed by the cluster administrator.
60
74
61
-
When using a plugin that is not one of the [default plugins](/docs/reference/scheduling/config/#scheduling-plugins), consider disabling the `queueSort`, `filter` and `permit` extension points as follows:
75
+
When using a plugin that is not one of the [default plugins](/docs/reference/scheduling/config/#scheduling-plugins),
76
+
consider disabling the `queueSort`, `filter` and `permit` extension points as follows:
62
77
63
78
```yaml
64
79
apiVersion: kubescheduler.config.k8s.io/v1
@@ -84,7 +99,8 @@ profiles:
84
99
This creates a scheduler profile ` my-scheduler`.
85
100
Whenever the `.spec` of a Pod does not have a value for `.spec.schedulerName`, the kube-scheduler runs for that Pod,
86
101
using its main configuration, and default plugins.
87
-
If you define a Pod with `.spec.schedulerName` set to `my-scheduler`, the kube-scheduler runs but with a custom configuration; in that custom configuration,
102
+
If you define a Pod with `.spec.schedulerName` set to `my-scheduler`, the kube-scheduler runs
103
+
but with a custom configuration; in that custom configuration,
88
104
the `queueSort`, `filter` and `permit` extension points are disabled.
89
105
If you use this KubeSchedulerConfiguration, and don't run any custom scheduler,
90
106
and you then define a Pod with `.spec.schedulerName` set to `nonexistent-scheduler`
To use this feature in Kubernetes {{< skew currentVersion >}}, you must enable support for ClusterTrustBundle objects with the `ClusterTrustBundle`[feature gate](/docs/reference/command-line-tools-reference/feature-gates/) and `--runtime-config=certificates.k8s.io/v1beta1/clustertrustbundles=true` kube-apiserver flag, then enable the `ClusterTrustBundleProjection` feature gate.
80
+
To use this feature in Kubernetes {{< skew currentVersion >}}, you must enable support for ClusterTrustBundle objects
81
+
with the `ClusterTrustBundle`[feature gate](/docs/reference/command-line-tools-reference/feature-gates/) and
then enable the `ClusterTrustBundleProjection` feature gate.
81
84
{{< /note >}}
82
85
83
-
The `clusterTrustBundle` projected volume source injects the contents of one or more [ClusterTrustBundle](/docs/reference/access-authn-authz/certificate-signing-requests#cluster-trust-bundles) objects as an automatically-updating file in the container filesystem.
86
+
The `clusterTrustBundle` projected volume source injects the contents of one or more
objects as an automatically-updating file in the container filesystem.
84
89
85
-
ClusterTrustBundles can be selected either by [name](/docs/reference/access-authn-authz/certificate-signing-requests#ctb-signer-unlinked) or by [signer name](/docs/reference/access-authn-authz/certificate-signing-requests#ctb-signer-linked).
90
+
ClusterTrustBundles can be selected either by [name](/docs/reference/access-authn-authz/certificate-signing-requests#ctb-signer-unlinked)
91
+
or by [signer name](/docs/reference/access-authn-authz/certificate-signing-requests#ctb-signer-linked).
86
92
87
93
To select by name, use the `name` field to designate a single ClusterTrustBundle object.
88
94
@@ -91,22 +97,26 @@ To select by signer name, use the `signerName` field (and optionally the
91
97
the given signer name. If `labelSelector` is not present, then all
92
98
ClusterTrustBundles for that signer are selected.
93
99
94
-
The kubelet deduplicates the certificates in the selected ClusterTrustBundle objects, normalizes the PEM representations (discarding comments and headers), reorders the certificates, and writes them into the file named by `path`. As the set of selected ClusterTrustBundles or their content changes, kubelet keeps the file up-to-date.
100
+
The kubelet deduplicates the certificates in the selected ClusterTrustBundle objects,
101
+
normalizes the PEM representations (discarding comments and headers), reorders the certificates,
102
+
and writes them into the file named by `path`.
103
+
As the set of selected ClusterTrustBundles or their content changes, kubelet keeps the file up-to-date.
95
104
96
-
By default, the kubelet will prevent the pod from starting if the named ClusterTrustBundle is not found, or if `signerName` / `labelSelector` do not match any ClusterTrustBundles. If this behavior is not what you want, then set the `optional` field to `true`, and the pod will start up with an empty file at `path`.
105
+
By default, the kubelet will prevent the pod from starting if the named ClusterTrustBundle is not found,
106
+
or if `signerName` / `labelSelector` do not match any ClusterTrustBundles.
107
+
If this behavior is not what you want, then set the `optional` field to `true`,
108
+
and the pod will start up with an empty file at `path`.
Certificates using the `PodCertificateRequest`[feature gate](/docs/reference/command-line-tools-reference/feature-gates/)
119
+
and the `--runtime-config=certificates.k8s.io/v1beta1/podcertificaterequests=true`
110
120
kube-apiserver flag.
111
121
{{< /note >}}
112
122
@@ -140,7 +150,8 @@ Each `podCertificate` projection supports the following configuration fields:
140
150
write *just* the private key or certificate chain.
141
151
*`userAnnotations`: a map that allows you to pass additional information to
142
152
the signer implementation. It is copied verbatim into the
143
-
`spec.unverifiedUserAnnotations` field of the [PodCertificateRequest](docs/reference/access-authn-authz/certificate-signing-requests#pod-certificate-requests) objects
that Kubelet creates. Entries are subject to the same validation as object
145
156
metadata annotations, with the addition that all keys must be domain-prefixed.
146
157
No restrictions are placed on values, except an overall size limitation on the
@@ -167,7 +178,9 @@ resulting in your application loading a mismatched key and certificate.
167
178
168
179
## SecurityContext interactions
169
180
170
-
The [proposal](https://git.k8s.io/enhancements/keps/sig-storage/2451-service-account-token-volumes#proposal) for file permission handling in projected service account volume enhancement introduced the projected files having the correct owner permissions set.
181
+
The [proposal](https://git.k8s.io/enhancements/keps/sig-storage/2451-service-account-token-volumes#proposal)
182
+
for file permission handling in projected service account volume enhancement
183
+
introduced the projected files having the correct owner permissions set.
0 commit comments