diff options
| author | Tim Hockin <thockin@google.com> | 2015-07-13 13:27:56 -0700 |
|---|---|---|
| committer | Tim Hockin <thockin@google.com> | 2015-07-13 13:27:56 -0700 |
| commit | 087b173f86a5e5ff42f9bfe4bf07af42a34ad503 (patch) | |
| tree | a3849f6a63c565ed0d9161662112cd9436bc363c | |
| parent | 8601b6ff40148c7be7a02a4a70ccfd1d9e231c33 (diff) | |
| parent | 7c1abe54bef9502d91d4b929497cc2c6d1a85c08 (diff) | |
Merge pull request #10843 from jiangyaoguo/change-get-minions-in-docs
change "get minions" to "get nodes" in docs
| -rw-r--r-- | clustering.md | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/clustering.md b/clustering.md index f88157aa..95ff3ccc 100644 --- a/clustering.md +++ b/clustering.md @@ -55,7 +55,7 @@ The building blocks of an easier solution: * **Move to TLS** We will move to using TLS for all intra-cluster communication. We will explicitly identify the trust chain (the set of trusted CAs) as opposed to trusting the system CAs. We will also use client certificates for all AuthN. * [optional] **API driven CA** Optionally, we will run a CA in the master that will mint certificates for the nodes/kubelets. There will be pluggable policies that will automatically approve certificate requests here as appropriate. * **CA approval policy** This is a pluggable policy object that can automatically approve CA signing requests. Stock policies will include `always-reject`, `queue` and `insecure-always-approve`. With `queue` there would be an API for evaluating and accepting/rejecting requests. Cloud providers could implement a policy here that verifies other out of band information and automatically approves/rejects based on other external factors. -* **Scoped Kubelet Accounts** These accounts are per-minion and (optionally) give a minion permission to register itself. +* **Scoped Kubelet Accounts** These accounts are per-node and (optionally) give a node permission to register itself. * To start with, we'd have the kubelets generate a cert/account in the form of `kubelet:<host>`. To start we would then hard code policy such that we give that particular account appropriate permissions. Over time, we can make the policy engine more generic. * [optional] **Bootstrap API endpoint** This is a helper service hosted outside of the Kubernetes cluster that helps with initial discovery of the master. |
