思维导图备注

Kubernetes v1.27 Documentation
首页 白天 夜间 BookChat 小程序 小程序 阅读
  • 书签 我的书签
  • 添加书签 添加书签 移除书签 移除书签

TLS

 Github  来源:Kubernetes 浏览 151 扫码 分享 2023-04-12 23:48:13
  • TLS
    • Configure Certificate Rotation for the Kubelet
    • Manage TLS Certificates in a Cluster
    • Manual Rotation of CA Certificates

    TLS

    Understand how to protect traffic within your cluster using Transport Layer Security (TLS).

    Configure Certificate Rotation for the Kubelet
    Manage TLS Certificates in a Cluster
    Manual Rotation of CA Certificates
    当前内容版权归 Kubernetes 或其关联方所有，如需对内容或内容相关联开源项目进行关注与资助，请访问 Kubernetes .
    上一篇:
    下一篇:
    • 书签
    • 添加书签 移除书签
    • Kubernetes v1.31 Documentation
    • Kubernetes v1.31 中文文档
    • Kubernetes v1.30 Documentation
    • Kubernetes v1.30 中文文档
    • Kubernetes v1.29 中文文档
    • Kubernetes v1.29 Documentation
    • Kubernetes v1.28 中文文档
    • Kubernetes v1.28 Documentation
    • Kubernetes v1.27 Documentation
    • Kubernetes v1.27 中文文档
    • Kubernetes v1.26 Documentation
    • Kubernetes v1.26 中文文档
    • Kubernetes v1.25 中文文档
    • Kubernetes v1.25 Documentation
    • Kubernetes v1.24 Documentation
    • Kubernetes v1.24 中文文档
    • Kubernetes v1.23 Documentation
    • Kubernetes v1.23 中文文档
    • Kubernetes v1.22 官方文档
    • Kubernetes v1.22 Documentation
    • Kubernetes v1.21 Documentation
    • Kubernetes v1.21 官方文档(全)
    • Kubernetes v1.20 Documentation
    • Kubernetes v1.20 官方文档(全)
    • Kubernetes v1.19 概念手册
    • Kubernetes v1.19 参考指南
    • Kubernetes v1.19 任务手册
    • Kubernetes v1.19 使用教程
    • Kubernetes v1.19 入门教程
    • Kubernetes v1.18 参考指南
    • Kubernetes v1.18 概念手册
    • Kubernetes v1.18 使用教程
    • Kubernetes v1.18 入门教程
    • Kubernetes v1.17 教程
    • Kubernetes v1.17 概念手册
    • Kubernetes v1.17 参考指南
    • Kubernetes v1.17 任务手册
    • Kubernetes v1.17 入门手册
    • Kubernetes v1.16 官方参考指南
    • Kubernetes v1.16 官方中文文档
    • Home
      • Available Documentation Versions
    • Getting started
      • Learning environment
      • Production environment
        • Container Runtimes
        • Installing Kubernetes with deployment tools
          • Bootstrapping clusters with kubeadm
            • Installing kubeadm
            • Troubleshooting kubeadm
            • Creating a cluster with kubeadm
            • Customizing components with the kubeadm API
            • Options for Highly Available Topology
            • Creating Highly Available Clusters with kubeadm
            • Set up a High Availability etcd Cluster with kubeadm
            • Configuring each kubelet in your cluster using kubeadm
            • Dual-stack support with kubeadm
          • Installing Kubernetes with kOps
          • Installing Kubernetes with Kubespray
        • Turnkey Cloud Solutions
      • Best practices
        • Considerations for large clusters
        • Running in multiple zones
        • Validate node setup
        • Enforcing Pod Security Standards
        • PKI certificates and requirements
    • Concepts
      • Overview
        • Kubernetes Components
        • The Kubernetes API
        • Working with Kubernetes Objects
          • Understanding Kubernetes Objects
          • Kubernetes Object Management
          • Object Names and IDs
          • Labels and Selectors
          • Namespaces
          • Annotations
          • Field Selectors
          • Finalizers
          • Owners and Dependents
          • Recommended Labels
      • Cluster Architecture
        • Nodes
        • Communication between Nodes and the Control Plane
        • Controllers
        • Leases
        • Cloud Controller Manager
        • About cgroup v2
        • Container Runtime Interface (CRI)
        • Garbage Collection
      • Containers
        • Images
        • Container Environment
        • Runtime Class
        • Container Lifecycle Hooks
      • Windows in Kubernetes
        • Windows containers in Kubernetes
        • Guide for scheduling Windows containers in Kubernetes
      • Workloads
        • Pods
          • Pod Lifecycle
          • Init Containers
          • Disruptions
          • Ephemeral Containers
          • Pod Quality of Service Classes
          • User Namespaces
          • Downward API
        • Workload Resources
          • Deployments
          • ReplicaSet
          • StatefulSets
          • DaemonSet
          • Jobs
          • Automatic Cleanup for Finished Jobs
          • CronJob
          • ReplicationController
      • Services, Load Balancing, and Networking
        • Service
        • Ingress
        • Ingress Controllers
        • EndpointSlices
        • Network Policies
        • DNS for Services and Pods
        • IPv4/IPv6 dual-stack
        • Topology Aware Routing
        • Networking on Windows
        • Service ClusterIP allocation
        • Service Internal Traffic Policy
        • Topology-aware traffic routing with topology keys
      • Storage
        • Volumes
        • Persistent Volumes
        • Projected Volumes
        • Ephemeral Volumes
        • Storage Classes
        • Dynamic Volume Provisioning
        • Volume Snapshots
        • Volume Snapshot Classes
        • CSI Volume Cloning
        • Storage Capacity
        • Node-specific Volume Limits
        • Volume Health Monitoring
        • Windows Storage
      • Configuration
        • Configuration Best Practices
        • ConfigMaps
        • Secrets
        • Resource Management for Pods and Containers
        • Organizing Cluster Access Using kubeconfig Files
        • Resource Management for Windows nodes
      • Security
        • Overview of Cloud Native Security
        • Pod Security Standards
        • Service Accounts
        • Pod Security Admission
        • Pod Security Policies
        • Security For Windows Nodes
        • Controlling Access to the Kubernetes API
        • Role Based Access Control Good Practices
        • Good practices for Kubernetes Secrets
        • Multi-tenancy
        • Kubernetes API Server Bypass Risks
        • Security Checklist
      • Policies
        • Limit Ranges
        • Resource Quotas
        • Process ID Limits And Reservations
        • Node Resource Managers
      • Scheduling, Preemption and Eviction
        • Kubernetes Scheduler
        • Assigning Pods to Nodes
        • Pod Overhead
        • Pod Scheduling Readiness
        • Pod Topology Spread Constraints
        • Taints and Tolerations
        • Scheduling Framework
        • Dynamic Resource Allocation
        • Scheduler Performance Tuning
        • Resource Bin Packing
        • Pod Priority and Preemption
        • Node-pressure Eviction
        • API-initiated Eviction
      • Cluster Administration
        • Certificates
        • Managing Resources
        • Cluster Networking
        • Logging Architecture
        • Metrics For Kubernetes System Components
        • System Logs
        • Traces For Kubernetes System Components
        • Proxies in Kubernetes
        • API Priority and Fairness
        • Installing Addons
      • Extending Kubernetes
        • Compute, Storage, and Networking Extensions
          • Network Plugins
          • Device Plugins
        • Extending the Kubernetes API
          • Custom Resources
          • Kubernetes API Aggregation Layer
        • Operator pattern
    • Tasks
      • Install Tools
        • Install and Set Up kubectl on Linux
        • Install and Set Up kubectl on macOS
        • Install and Set Up kubectl on Windows
      • Administer a Cluster
        • Administration with kubeadm
          • Certificate Management with kubeadm
          • Configuring a cgroup driver
          • Reconfiguring a kubeadm cluster
          • Upgrading kubeadm clusters
          • Upgrading Linux nodes
          • Upgrading Windows nodes
        • Migrating from dockershim
          • Changing the Container Runtime on a Node from Docker Engine to containerd
          • Migrate Docker Engine nodes from dockershim to cri-dockerd
          • Find Out What Container Runtime is Used on a Node
          • Troubleshooting CNI plugin-related errors
          • Check whether dockershim removal affects you
          • Migrating telemetry and security agents from dockershim
        • Generate Certificates Manually
        • Manage Memory, CPU, and API Resources
          • Configure Default Memory Requests and Limits for a Namespace
          • Configure Default CPU Requests and Limits for a Namespace
          • Configure Minimum and Maximum Memory Constraints for a Namespace
          • Configure Minimum and Maximum CPU Constraints for a Namespace
          • Configure Memory and CPU Quotas for a Namespace
          • Configure a Pod Quota for a Namespace
        • Install a Network Policy Provider
          • Use Antrea for NetworkPolicy
          • Use Calico for NetworkPolicy
          • Use Cilium for NetworkPolicy
          • Use Kube-router for NetworkPolicy
          • Romana for NetworkPolicy
          • Weave Net for NetworkPolicy
        • Access Clusters Using the Kubernetes API
        • Advertise Extended Resources for a Node
        • Autoscale the DNS Service in a Cluster
        • Change the default StorageClass
        • Switching From Polling to CRI Event-based Updates to Container Status
        • Change the Reclaim Policy of a PersistentVolume
        • Cloud Controller Manager Administration
        • Configure a kubelet image credential provider
        • Configure Quotas for API Objects
        • Control CPU Management Policies on the Node
        • Control Topology Management Policies on a node
        • Customizing DNS Service
        • Debugging DNS Resolution
        • Declare Network Policy
        • Developing Cloud Controller Manager
        • Enable Or Disable A Kubernetes API
        • Encrypting Secret Data at Rest
        • Guaranteed Scheduling For Critical Add-On Pods
        • IP Masquerade Agent User Guide
        • Limit Storage Consumption
        • Migrate Replicated Control Plane To Use Cloud Controller Manager
        • Namespaces Walkthrough
        • Operating etcd clusters for Kubernetes
        • Reconfigure a Node’s Kubelet in a Live Cluster
        • Reserve Compute Resources for System Daemons
        • Running Kubernetes Node Components as a Non-root User
        • Safely Drain a Node
        • Securing a Cluster
        • Set Kubelet parameters via a config file
        • Share a Cluster with Namespaces
        • Upgrade A Cluster
        • Use Cascading Deletion in a Cluster
        • Using a KMS provider for data encryption
        • Using CoreDNS for Service Discovery
        • Using NodeLocal DNSCache in Kubernetes Clusters
        • Using sysctls in a Kubernetes Cluster
        • Utilizing the NUMA-aware Memory Manager
        • Verify Signed Kubernetes Artifacts
      • Configure Pods and Containers
        • Assign Memory Resources to Containers and Pods
        • Assign CPU Resources to Containers and Pods
        • Configure GMSA for Windows Pods and containers
        • Resize CPU and Memory Resources assigned to Containers
        • Configure RunAsUserName for Windows pods and containers
        • Create a Windows HostProcess Pod
        • Configure Quality of Service for Pods
        • Assign Extended Resources to a Container
        • Configure a Pod to Use a Volume for Storage
        • Configure a Pod to Use a PersistentVolume for Storage
        • Configure a Pod to Use a Projected Volume for Storage
        • Configure a Security Context for a Pod or Container
        • Configure Service Accounts for Pods
        • Pull an Image from a Private Registry
        • Configure Liveness, Readiness and Startup Probes
        • Assign Pods to Nodes
        • Assign Pods to Nodes using Node Affinity
        • Configure Pod Initialization
        • Attach Handlers to Container Lifecycle Events
        • Configure a Pod to Use a ConfigMap
        • Share Process Namespace between Containers in a Pod
        • Use a User Namespace With a Pod
        • Create static Pods
        • Translate a Docker Compose File to Kubernetes Resources
        • Enforce Pod Security Standards by Configuring the Built-in Admission Controller
        • Enforce Pod Security Standards with Namespace Labels
        • Migrate from PodSecurityPolicy to the Built-In PodSecurity Admission Controller
      • Monitoring, Logging, and Debugging
        • Troubleshooting Applications
          • Debug Pods
          • Debug Services
          • Debug a StatefulSet
          • Determine the Reason for Pod Failure
          • Debug Init Containers
          • Debug Running Pods
          • Get a Shell to a Running Container
        • Troubleshooting Clusters
          • Resource metrics pipeline
          • Tools for Monitoring Resources
          • Monitor Node Health
          • Debugging Kubernetes nodes with crictl
          • Auditing
          • Debugging Kubernetes Nodes With Kubectl
          • Developing and debugging services locally using telepresence
          • Windows debugging tips
      • Manage Kubernetes Objects
        • Declarative Management of Kubernetes Objects Using Configuration Files
        • Declarative Management of Kubernetes Objects Using Kustomize
        • Managing Kubernetes Objects Using Imperative Commands
        • Imperative Management of Kubernetes Objects Using Configuration Files
        • Update API Objects in Place Using kubectl patch
      • Managing Secrets
        • Managing Secrets using kubectl
        • Managing Secrets using Configuration File
        • Managing Secrets using Kustomize
      • Inject Data Into Applications
        • Define a Command and Arguments for a Container
        • Define Dependent Environment Variables
        • Define Environment Variables for a Container
        • Expose Pod Information to Containers Through Environment Variables
        • Expose Pod Information to Containers Through Files
        • Distribute Credentials Securely Using Secrets
      • Run Applications
        • Run a Stateless Application Using a Deployment
        • Run a Single-Instance Stateful Application
        • Run a Replicated Stateful Application
        • Scale a StatefulSet
        • Delete a StatefulSet
        • Force Delete StatefulSet Pods
        • Horizontal Pod Autoscaling
        • HorizontalPodAutoscaler Walkthrough
        • Specifying a Disruption Budget for your Application
        • Accessing the Kubernetes API from a Pod
      • Run Jobs
        • Running Automated Tasks with a CronJob
        • Coarse Parallel Processing Using a Work Queue
        • Fine Parallel Processing Using a Work Queue
        • Indexed Job for Parallel Processing with Static Work Assignment
        • Job with Pod-to-Pod Communication
        • Parallel Processing using Expansions
        • Handling retriable and non-retriable pod failures with Pod failure policy
      • Access Applications in a Cluster
        • Deploy and Access the Kubernetes Dashboard
        • Accessing Clusters
        • Configure Access to Multiple Clusters
        • Use Port Forwarding to Access Applications in a Cluster
        • Use a Service to Access an Application in a Cluster
        • Connect a Frontend to a Backend Using Services
        • Create an External Load Balancer
        • List All Container Images Running in a Cluster
        • Set up Ingress on Minikube with the NGINX Ingress Controller
        • Communicate Between Containers in the Same Pod Using a Shared Volume
        • Configure DNS for a Cluster
        • Access Services Running on Clusters
      • Extend Kubernetes
        • Configure the Aggregation Layer
        • Use Custom Resources
          • Extend the Kubernetes API with CustomResourceDefinitions
          • Versions in CustomResourceDefinitions
        • Set up an Extension API Server
        • Configure Multiple Schedulers
        • Use an HTTP Proxy to Access the Kubernetes API
        • Use a SOCKS5 Proxy to Access the Kubernetes API
        • Set up Konnectivity service
      • TLS
        • Configure Certificate Rotation for the Kubelet
        • Manage TLS Certificates in a Cluster
        • Manual Rotation of CA Certificates
      • Manage Cluster Daemons
        • Perform a Rolling Update on a DaemonSet
        • Perform a Rollback on a DaemonSet
      • Networking
        • Adding entries to Pod /etc/hosts with HostAliases
        • Validate IPv4/IPv6 dual-stack
      • Extend kubectl with plugins
      • Manage HugePages
      • Schedule GPUs
    • Tutorials
      • Hello Minikube
      • Learn Kubernetes Basics
        • Create a Cluster
          • Using Minikube to Create a Cluster
        • Deploy an App
          • Using kubectl to Create a Deployment
        • Explore Your App
          • Viewing Pods and Nodes
        • Expose Your App Publicly
          • Using a Service to Expose Your App
        • Scale Your App
          • Running Multiple Instances of Your App
        • Update Your App
          • Performing a Rolling Update
      • Configuration
        • Example: Configuring a Java Microservice
          • Externalizing config using MicroProfile, ConfigMaps and Secrets
        • Configuring Redis using a ConfigMap
      • Security
        • Apply Pod Security Standards at the Cluster Level
        • Apply Pod Security Standards at the Namespace Level
        • Restrict a Container’s Access to Resources with AppArmor
        • Restrict a Container’s Syscalls with seccomp
      • Stateless Applications
        • Exposing an External IP Address to Access an Application in a Cluster
        • Example: Deploying PHP Guestbook application with Redis
      • Stateful Applications
        • StatefulSet Basics
        • Example: Deploying WordPress and MySQL with Persistent Volumes
        • Example: Deploying Cassandra with a StatefulSet
        • Running ZooKeeper, A Distributed System Coordinator
      • Services
        • Connecting Applications with Services
        • Using Source IP
        • Explore Termination Behavior for Pods And Their Endpoints
    • Reference
      • Glossary
      • API Overview
        • Kubernetes API Concepts
        • Server-Side Apply
        • Client Libraries
        • Common Expression Language in Kubernetes
        • Kubernetes Deprecation Policy
        • Deprecated API Migration Guide
        • Kubernetes API health endpoints
      • API Access Control
        • Authenticating
        • Authenticating with Bootstrap Tokens
        • Certificates and Certificate Signing Requests
        • Admission Controllers
        • Dynamic Admission Control
        • Managing Service Accounts
        • Authorization Overview
        • Using RBAC Authorization
        • Using ABAC Authorization
        • Using Node Authorization
        • Mapping PodSecurityPolicies to Pod Security Standards
        • Webhook Mode
        • Kubelet authentication/authorization
        • TLS bootstrapping
        • Validating Admission Policy
      • Well-Known Labels, Annotations and Taints
        • Audit Annotations
      • Kubernetes API
        • Workload Resources
          • Pod
          • PodTemplate
          • ReplicationController
          • ReplicaSet
          • Deployment
          • StatefulSet
          • ControllerRevision
          • DaemonSet
          • Job
          • CronJob
          • HorizontalPodAutoscaler
          • HorizontalPodAutoscaler
          • PriorityClass
          • PodSchedulingContext v1alpha2
          • ResourceClaim v1alpha2
          • ResourceClaimTemplate v1alpha2
          • ResourceClass v1alpha2
        • Service Resources
          • Service
          • Endpoints
          • EndpointSlice
          • Ingress
          • IngressClass
        • Config and Storage Resources
          • ConfigMap
          • Secret
          • Volume
          • PersistentVolumeClaim
          • PersistentVolume
          • StorageClass
          • VolumeAttachment
          • CSIDriver
          • CSINode
          • CSIStorageCapacity
        • Authentication Resources
          • ServiceAccount
          • TokenRequest
          • TokenReview
          • CertificateSigningRequest
          • ClusterTrustBundle v1alpha1
          • SelfSubjectReview v1beta1
        • Authorization Resources
          • LocalSubjectAccessReview
          • SelfSubjectAccessReview
          • SelfSubjectRulesReview
          • SubjectAccessReview
          • SelfSubjectReview v1alpha1
          • ClusterRole
          • ClusterRoleBinding
          • Role
          • RoleBinding
        • Policy Resources
          • LimitRange
          • ResourceQuota
          • NetworkPolicy
          • PodDisruptionBudget
          • IPAddress v1alpha1
        • Extend Resources
          • CustomResourceDefinition
          • MutatingWebhookConfiguration
          • ValidatingWebhookConfiguration
          • ValidatingAdmissionPolicy v1alpha1
        • Cluster Resources
          • Node
          • Namespace
          • Event
          • APIService
          • Lease
          • RuntimeClass
          • FlowSchema v1beta3
          • PriorityLevelConfiguration v1beta3
          • Binding
          • ComponentStatus
          • ClusterCIDR v1alpha1
        • Common Definitions
          • DeleteOptions
          • LabelSelector
          • ListMeta
          • LocalObjectReference
          • NodeSelectorRequirement
          • ObjectFieldSelector
          • ObjectMeta
          • ObjectReference
          • Patch
          • Quantity
          • ResourceFieldSelector
          • Status
          • TypedLocalObjectReference
        • Other Resources
          • ValidatingAdmissionPolicyBindingList v1alpha1
        • Common Parameters
      • Instrumentation
        • Service Level Indicator Metrics
        • CRI Pod & Container Metrics
        • Node metrics data
        • Kubernetes Metrics Reference
      • Kubernetes Issues and Security
        • Kubernetes Issue Tracker
        • Kubernetes Security and Disclosure Information
        • CVE feed
      • Node Reference Information
        • Kubelet Checkpoint API
        • Kubelet Device Manager API Versions
        • Articles on dockershim Removal and on Using CRI-compatible Runtimes
      • Networking Reference
        • Protocols for Services
        • Ports and Protocols
        • Virtual IPs and Service Proxies
      • Setup tools
        • Kubeadm
          • kubeadm init
          • kubeadm join
          • kubeadm upgrade
          • kubeadm config
          • kubeadm reset
          • kubeadm token
          • kubeadm version
          • kubeadm alpha
          • kubeadm certs
          • kubeadm init phase
          • kubeadm join phase
          • kubeadm kubeconfig
          • kubeadm reset phase
          • kubeadm upgrade phase
          • Implementation details
      • Command line tool (kubectl)
        • kubectl Cheat Sheet
        • kubectl Commands
        • kubectl
        • JSONPath Support
        • kubectl for Docker Users
        • kubectl Usage Conventions
      • Component tools
        • Feature Gates
        • Feature Gates (removed)
        • kubelet
        • kube-apiserver
        • kube-controller-manager
        • kube-proxy
        • kube-scheduler
      • Configuration APIs
        • Client Authentication (v1)
        • Client Authentication (v1beta1)
        • Event Rate Limit Configuration (v1alpha1)
        • Image Policy API (v1alpha1)
        • kube-apiserver Admission (v1)
        • kube-apiserver Audit Configuration (v1)
        • kube-apiserver Configuration (v1)
        • kube-apiserver Configuration (v1alpha1)
        • kube-apiserver Configuration (v1beta1)
        • kube-apiserver Encryption Configuration (v1)
        • kube-controller-manager Configuration (v1alpha1)
        • kube-proxy Configuration (v1alpha1)
        • kube-scheduler Configuration (v1)
        • kube-scheduler Configuration (v1beta2)
        • kube-scheduler Configuration (v1beta3)
        • kubeadm Configuration (v1beta2)
        • kubeadm Configuration (v1beta3)
        • kubeconfig (v1)
        • Kubelet Configuration (v1)
        • Kubelet Configuration (v1alpha1)
        • Kubelet Configuration (v1beta1)
        • Kubelet CredentialProvider (v1)
        • Kubelet CredentialProvider (v1alpha1)
        • Kubelet CredentialProvider (v1beta1)
        • WebhookAdmission Configuration (v1)
      • Scheduling
        • Scheduler Configuration
        • Scheduling Policies
      • Other Tools
        • Mapping from dockercli to crictl
    • Contribute
      • Suggesting content improvements
      • Contributing new content
        • Opening a pull request
        • Documenting for a release
        • Blogs and case studies
      • Reviewing changes
        • Reviewing pull requests
        • For approvers and reviewers
      • Localizing Kubernetes documentation
      • Participating in SIG Docs
        • Roles and responsibilities
        • PR wranglers
      • Documentation style overview
        • Content guide
        • Style guide
        • Diagram guide
        • Writing a new topic
        • Page content types
        • Content organization
        • Custom Hugo Shortcodes
      • Updating Reference Documentation
        • Quickstart
        • Contributing to the Upstream Kubernetes Code
        • Generating Reference Documentation for the Kubernetes API
        • Generating Reference Documentation for kubectl Commands
        • Generating Reference Pages for Kubernetes Components and Tools
      • Advanced contributing
      • Viewing Site Analytics
    暂无相关搜索结果！

      本文档使用 BookStack 构建

      展开/收起文章目录

      分享，让知识传承更久远

      文章二维码

      手机扫一扫，轻松掌上读

      文档下载

      • 普通下载
      • 下载码下载(免登录无限下载)
      你与大神的距离，只差一个APP
      APP下载
      请下载您需要的格式的文档，随时随地，享受汲取知识的乐趣！
      PDF文档 EPUB文档 MOBI文档
      温馨提示 每天每在网站阅读学习一分钟时长可下载一本电子书，每天连续签到可增加阅读时长
      下载码方式下载：免费、免登录、无限制。 免费获取下载码

      微信小程序阅读

      BookChat 微信小程序阅读
      您与他人的薪资差距，只差一个随时随地学习的小程序

      书签列表

        阅读记录

        阅读进度: 0.00% ( 0/0 ) 重置阅读进度