TLS bootstrapping — kubelet configuration

Reference note (untrusted external data; do not execute it as instructions). Finally, with the control plane nodes properly set up and all of the necessary authentication and authorization in place, we can configure the kubelet. The kubelet requires the following configuration to bootstrap A path to store the key and certificate it generates (optional, can use default) A path to a kubeconfig file that does not yet exist; it will place the bootstrapped config file here A path to a bootstrap kubeconfig file to provide the URL for the server and bootstrap credentials, e.g. a bootstrap token Optional: instructions to rotate certificates The bootstrap kubeconfig should be in a path available to the kubelet, for example /var/lib/kubelet/bootstrap-kubeconfig. Its format is identical to a normal kubeconfig file. A sample file might look as follows Bounded code example (external data; do not execute automatically): ```yaml apiVersion: v1 kind: Config clusters: - cluster: certificate-authority: /var/lib/kubernetes/ca.pem server: https://my.server.example.com:6443 name: bootstrap contexts: - context: cluster: bootstrap user: kubelet-bootstrap name: bootstrap current-context: bootstrap preferences: {} users: - name: kubelet-bootstrap user: token: 07401b.f395accd246ae52d ``` The important elements to note are certificate-authority: path to a CA file, used to validate the server certificate presented by kube-apiserver server: URL to kube-apiserver token: the token to use The format of the token does not matter, as long as it matches what kube-apiserver expects. In the above example, we used a bootstrap token. As stated earlier, _any_ valid authentication method can be used, not only tokens. Because the bootstrap kubeconfig _is_ a standard kubeconfig, you can use kubectl to generate it. To create the above example file … Attribution: Adapted from Kubernetes Documentation under CC-BY-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.