Home / server / Questions / 1014105
Accepted
srinu259
Asked: 2020-04-26 04:33:21 +0800 CST

Why do kubernetes kube-api server need etcd-keyfile and kubelet-client-key

  • 772

As I understand kube-api server acts as a client when communicating with ETCD and Kubelet. Both ETCD and Kubelet act as servers for kube-api. With secure environment (two way SSL authentication), kube-api server needs the ETCD and Kubelet certificates and the CA certificate. What I don't understand is why do we need to provide the private keys of ETCD (etcd-keyfile) and Kubelet (kubelet-client-key) while configuring kube-apiserver.yaml ?

kubernetes etcd

1 Answers

  1. Best Answer

    Because etcd uses X.509 mutual TLS authentication in kubernetes, so the apiserver needs to be able to prove it has ownership over the client certificate that is presented to the server, and that happens via private key

    There are other authentication options for etcd, but kubernetes doesn't use them, and it's unclear if the apiserver even offers a non-TLS authentication option for connecting to etcd, even if you wanted to

    • 6