ssl - 为什么 kubelet 使用 TLS 与 apiserver 通信需要密码？v1.3

Question

我在主节点上使用 TLS 部署了 apiserver，它工作正常，当我部署 kubelet 和 tring 与 apiserver 通信时出现了我的问题。kubelet 配置如下:

/opt/bin/kubelet \
  --logtostderr=true \
  --v=0 \
  --api_servers=https://kube-master:6443 \
  --address=0.0.0.0 \
  --port=10250 \
  --allow-privileged=false \
  --tls-cert-file="/var/run/kubernetes/kubelet_client.crt" \
  --tls-private-key-file="/var/run/kubernetes/kubelet_client.key"
  --kubeconfig="/var/lib/kubelet/kubeconfig"

/var/lib/kubelet/kubeconfig 如下:

apiVersion: v1
kind: Config
users:
- name: kubelet
  user:
    client-certificate: /var/run/kubernetes/kubelet_client.crt
    client-key: /var/run/kubernetes/kubelet_client.key
clusters:
- name: kube-cluster
  cluster:
    certificate-authority: /var/run/kubernetes/ca.crt
contexts:
- context:
    cluster: kube-cluster
    user: kubelet
  name: ctx-kube-system
current-context: ctx-kube-system

因为我想使用双向(客户端和服务器)CA 身份验证实现通信并期望得到一个不可靠的回复，但是 apiserver 要求我提供我以前从未使用过的用户名和密码，一些命令行如下:

> kubectl version
> Client Version: version.Info{Major:"1", Minor:"3", GitVersion:"v1.3.2", GitCommit:"9bafa3400a77c14ee50782bb05f9efc5c91b3185", GitTreeState:"clean", BuildDate:"2016-07-17T18:30:39Z", GoVersion:"go1.6.2", Compiler:"gc", Platform:"linux/amd64"}
> Please enter Username: kubelet
> Please enter Password: kubelet
> error: You must be logged in to the server (the server has asked for the client to provide credentials)

我在 master minion 上尝试了所有这些。有人可以解决这个难题吗？在此先感谢。

Answer 1

您必须通过 apiserver 上的 --client-ca-file 标志启用客户端证书授权。

来自 http://kubernetes.io/docs/admin/authentication/ :

Client certificate authentication is enabled by passing the --client-ca-file=SOMEFILE option to apiserver. The referenced file must contain one or more certificates authorities to use to validate client certificates presented to the apiserver. If a client certificate is presented and verified, the common name of the subject is used as the user name for the request.

来自 http://kubernetes.io/docs/admin/kube-apiserver/ :

--client-ca-file="": If set, any request presenting a client certificate signed by one of the authorities in the client-ca-file is authenticated with an identity corresponding to the CommonName of the client certificate. --cloud-config="": The path to the cloud provider configuration file. Empty string for no configuration file.