Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Assets for compute nodes #2832

Closed
gambol99 opened this issue Jun 29, 2017 · 0 comments
Closed

Assets for compute nodes #2832

gambol99 opened this issue Jun 29, 2017 · 0 comments
Labels
area/security

Comments

@gambol99
Copy link
Contributor

It not really necessary (or prudent) for the compute nodes to pull down all of the following assets.

core@ip-10-200-101-253 /srv/kubernetes $ ls -l
total 40
-rw-------. 1 root root   59 Jun 29 10:56 basic_auth.csv
-rw-r--r--. 1 root root 1046 Jun 29 10:56 ca.crt
-rw-------. 1 root root  530 Jun 29 10:56 known_tokens.csv
-rw-r--r--. 1 root root 1407 Jun 29 10:56 server.cert
-rw-r--r--. 1 root root 1679 Jun 29 10:56 server.key

Realistically the only file that's required here is the CA .. The rest should be protected by iam policy in the bucket and limited to the master nodes only.
@gambol99 gambol99 mentioned this issue Jul 26, 2017
Merged
k8s-github-robot pushed a commit that referenced this issue Jul 28, 2017
Merge pull request #3058 from gambol99/node_certs
6406aba 
Automatic merge from submit-queue

Node Secrets

As present a number of secrets are downloaded to the /src/kubernetes directory regardless of role (master, node). This limits the the node role to only donwload the ca.crt. The rest are for master nodes only

- removes basic_auth.csv, ca.key, known_tokens.csv, server.cert and server.key leaving only the ca.crt

```shell
core@ip-10-250-33-77 /srv/kubernetes $ ls
basic_auth.csv  ca.crt  ca.key  known_tokens.csv  server.cert  server.key
```
relates to #2832
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
area/security
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@chrislovecnm @gambol99