Public-key infrastructure

As explained in Acing the Certified Kubernetes Administrator Exam, Second Edition

Public key infrastructure is a security framework that uses public-key cryptography and trusted certificates to authenticate parties and protect communications.

Public-key infrastructure (PKI) secures Kubernetes client–server communication through certificates and a trusted certificate authority (CA). The CA signs certificates so clients can verify servers, while servers can require client certificates for mutual authentication. section 1.7

Kubernetes acts as its cluster CA and source of trust. kubectl, the kubelet, scheduler, controller manager, API server, and etcd use client or server certificates to authenticate requests and component connections. section 1.7 section 2.2.1

For practical inspection and exam preparation:

• List control-plane configuration with ls /etc/kubernetes; inspect kubelet.conf to find its API endpoint and client certificate path. section 2.2.1
• Review /etc/kubernetes/pki for the CA, API server, etcd-client, and kubelet-client certificates and keys. section 2.2.1
• Remember that one service can hold both certificates: the kubelet uses a client certificate for API authentication and a server certificate for proving its identity. section 2.2.1

Figure 2.14 Client and server certificate placement in Kubernetes

Use the certificate-placement diagram to map Kubernetes components to their client and server certificates. section 2.2.1

How Acing the Certified Kubernetes Administrator Exam, Second Edition covers it

How deep it goes

Explains the CA trust model and certificate locations, then stops short of certificate creation or management procedures.

Examples

Uses kubectl authentication, kubelet.conf, /etc/kubernetes, and /etc/kubernetes/pki as concrete inspection examples.

What it assumes

Assumes familiarity with kubectl and client-server communication while establishing certificates, CAs, and Kubernetes component identities.

What you can do after

Evaluate Kubernetes certificate-based authentication and locate component certificates during cluster inspection or CKA troubleshooting.

How it connects

Connects certificate authorities, client certificates, server certificates, mutual authentication, kubelet, scheduler, API server, controller manager, and etcd.

liveBookmanning.com

Read Acing the Certified Kubernetes Administrator Exam, Second Edition on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Real-World CryptographyThe web public key infrastructure is the ecosystem of browser-trusted authorities, certificates, and procedures that authenticates public keys for web connections.

Compare how 2 books explain public-key infrastructure →

Related concepts

• certificateuses · A digital certificate is a digitally signed credential that binds an identity to a public key and supports authentication or secure communication.
• certification authorityuses · A certification authority is a trusted entity that verifies identities and issues digitally signed certificates binding public keys to identities or domains.
• S/MIMEused by · S/MIME is a public-key cryptographic standard for digitally signing and encrypting email using certificates.
• browserused by · A web browser is software that retrieves, interprets, and renders web resources, executes supported web content, and enables interaction with web pages and applications.
• digital signatureuses · A digital signature is cryptographic data generated with a private key and verified with corresponding public information to authenticate data or its signer and detect alteration.
• Kubernetesused by · Kubernetes is an open-source platform for orchestrating and automating the deployment, scaling, and management of containerized workloads across computing clusters.

This explainer was generated by Manning's knowledge graph from the text of Acing the Certified Kubernetes Administrator Exam, Second Edition. The section links point to the parts of the book it draws on.