Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/04-certificate-authority.md
Original file line number Diff line number Diff line change
Expand Up @@ -84,7 +84,7 @@ The `ca.key` is used by the CA for signing certificates. And it should be secure

In this section you will generate client and server certificates for each Kubernetes component and a client certificate for the Kubernetes `admin` user.

To better understand the role of client certificates with respect to users and groups, see [this informative video](https://youtu.be/I-iVrIWfMl8). Note that all the kubenetes services below are themselves cluster users.
To better understand the role of client certificates with respect to users and groups, see [this informative video](https://youtu.be/I-iVrIWfMl8). Note that all the kubernetes services below are themselves cluster users.

### The Admin Client Certificate

Expand Down
2 changes: 1 addition & 1 deletion docs/08-bootstrapping-kubernetes-controllers.md
Original file line number Diff line number Diff line change
Expand Up @@ -285,7 +285,7 @@ CONTROL02=$(dig +short controlplane02)
LOADBALANCER=$(dig +short loadbalancer)
```

Create HAProxy configuration to listen on API server port on this host and distribute requests evently to the two controlplane nodes.
Create HAProxy configuration to listen on API server port on this host and distribute requests evenly to the two controlplane nodes.

We configure it to operate as a [layer 4](https://en.wikipedia.org/wiki/Transport_layer) loadbalancer (using `mode tcp`), which means it forwards any traffic directly to the backends without doing anything like [SSL offloading](https://ssl2buy.com/wiki/ssl-offloading).

Expand Down
6 changes: 3 additions & 3 deletions docs/10-bootstrapping-kubernetes-workers.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
In this lab you will bootstrap 2 Kubernetes worker nodes. We already installed `containerd` and its dependencies on these nodes in the previous lab.

We will now install the kubernetes components
- [kubelet](https://kubernetes.io/docs/admin/kubelet)
- [kubelet](https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/)
- [kube-proxy](https://kubernetes.io/docs/concepts/cluster-administration/proxies).

## Prerequisites
Expand All @@ -13,7 +13,7 @@ Once this is done, the commands are to be run on first worker instance: `node01`

### Provisioning Kubelet Client Certificates

Kubernetes uses a [special-purpose authorization mode](https://kubernetes.io/docs/admin/authorization/node/) called Node Authorizer, that specifically authorizes API requests made by [Kubelets](https://kubernetes.io/docs/concepts/overview/components/#kubelet). In order to be authorized by the Node Authorizer, Kubelets must use a credential that identifies them as being in the `system:nodes` group, with a username of `system:node:<nodeName>`. In this section you will create a certificate for each Kubernetes worker node that meets the Node Authorizer requirements.
Kubernetes uses a special-purpose authorization mode called [Node Authorizer](https://kubernetes.io/docs/reference/access-authn-authz/node/), that specifically authorizes API requests made by [Kubelets](https://kubernetes.io/docs/concepts/overview/components/#kubelet). In order to be authorized by the Node Authorizer, Kubelets must use a credential that identifies them as being in the `system:nodes` group, with a username of `system:node:<nodeName>`. In this section you will create a certificate for each Kubernetes worker node that meets the Node Authorizer requirements.

Generate a certificate and private key for one worker node:

Expand Down Expand Up @@ -54,7 +54,7 @@ node01.crt

### The kubelet Kubernetes Configuration File

When generating kubeconfig files for Kubelets the client certificate matching the Kubelet's node name must be used. This will ensure Kubelets are properly authorized by the Kubernetes [Node Authorizer](https://kubernetes.io/docs/admin/authorization/node/).
When generating kubeconfig files for Kubelets the client certificate matching the Kubelet's node name must be used. This will ensure Kubelets are properly authorized by the Kubernetes [Node Authorizer](https://kubernetes.io/docs/reference/access-authn-authz/node/).

Get the kube-api server load-balancer IP.

Expand Down
2 changes: 1 addition & 1 deletion vagrant/Vagrantfile
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
# Larger nodes will be created if you have more.
RAM_SIZE = 16

# Define how mnay CPU cores you have.
# Define how many CPU cores you have.
# More powerful workers will be created if you have more
CPU_CORES = 8

Expand Down