Oh, there are docs here too: https://kubernetes.io/docs/admin/kubelet-authentication-authorization/
On Wed, May 3, 2017 at 1:35 PM Brandon Philips <brandon.phil...@coreos.com> wrote: > Hello Qian- > > 10255 is the "read-only" port, to disable it remove --read-only-port from > kubelet config. > > To configure authentication on the kubelet port use --client-ca-file. The > API server has flags to authenticate using these CAs: > https://github.com/coreos/tectonic-installer/blob/master/modules/bootkube/resources/manifests/kube-apiserver.yaml#L45-L46 > > Hope that helps. > > Brandon > > On Wed, May 3, 2017 at 7:38 AM Qian Zhang <zhq527...@gmail.com> wrote: > >> Hi, >> >> I have a Kubernetes cluster, and currently the kubelet listens on two >> ports: 10250 and 10255, if I understand correctly, 10250 serves https and >> 10255 serves http. Now I can always run the following command to access >> kubelet: >> curl http://<node-IP>:10255/spec/ >> And and this command even for the https port: >> curl --insecure https://<node-IP>:10250/spec/ >> >> This is not secure to me, I do not want to expose http port, so I think I >> should start kubelet with the flag "--read-only-port=0" to disable 10255, >> and for the https port (10250), I do not want anonymous user to access it, >> and in the meantime I still want kube-apiserver can access kubelet (e.g., >> when I run "kubectl logs ...", kube-apiserver can still talk to kubelet to >> get logs), and I also want Heapster (running as a deployment in my >> Kubernetes cluster) can still access kubelet to get metrics. Can anyone >> please let me know what else flags I should specify to start kubelet? >> >> >> Thanks, >> Qian >> >> -- >> You received this message because you are subscribed to the Google Groups >> "Kubernetes user discussion and Q&A" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to kubernetes-users+unsubscr...@googlegroups.com. >> To post to this group, send email to kubernetes-users@googlegroups.com. >> Visit this group at https://groups.google.com/group/kubernetes-users. >> For more options, visit https://groups.google.com/d/optout. >> > -- You received this message because you are subscribed to the Google Groups "Kubernetes user discussion and Q&A" group. To unsubscribe from this group and stop receiving emails from it, send an email to kubernetes-users+unsubscr...@googlegroups.com. To post to this group, send email to kubernetes-users@googlegroups.com. Visit this group at https://groups.google.com/group/kubernetes-users. For more options, visit https://groups.google.com/d/optout.
