LAB06: Play with Cluster

LAB15 Play with cluster

Changing the Kubernetes cluster name (the one shown in kubeconfig as cluster: kubernetes) to an FQDN such as prod-k8s.xyz depends on whether your cluster is:

✔ kubeadm-created cluster ✔ self-managed control plane ❌ Managed clusters (EKS, AKS, GKE) → not possible (fixed by provider)

Below are the exact methods.

If You Are Using kubeadm (MOST COMMON)

The cluster name is embedded in these places:

1. /etc/kubernetes/kubeadm-config.yaml (ClusterConfiguration)

2. /etc/kubernetes/*.conf (Admin/kubelet kubeconfigs)

3. /root/.kube/config and your local kubeconfigs

You cannot just edit it live — kubeadm generates certificates with the cluster name & FQDN.

Two possible approaches:

🅰️ (Recommended) Use kubeadm to Reconfigure the Cluster Name

Step 1: Edit your kubeadm config file

Check if it exists:

sudo cat /etc/kubernetes/kubeadm-config.yaml

Look for:

clusterName: kubernetes

Modify it to:

clusterName: prod-k8s.xyz

Step 2: Apply kubeadm upgrades

sudo kubeadm upgrade apply --config /etc/kubernetes/kubeadm-config.yaml

OR for initial cluster-created config:

sudo kubeadm init phase upload-config all --config /etc/kubernetes/kubeadm-config.yaml

Step 3: Regenerate kubeconfigs

sudo kubeadm init phase kubeconfig all --config /etc/kubernetes/kubeadm-config.yaml

This regenerates:

• /etc/kubernetes/admin.conf

• /etc/kubernetes/controller-manager.conf

• /etc/kubernetes/scheduler.conf

• /var/lib/kubelet/kubeconfig

Step 4: Replace your local kubeconfig

mkdir -p $HOME/.kube
sudo cp /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $USER:$USER $HOME/.kube/config

---

🅱️ (Unsafe but Works) Manually Change Kubeconfig Cluster Name

If you only want kubeconfig to DISPLAY the FQDN (not cluster identity):

Edit your kubeconfig:

vim ~/.kube/config

Find:

clusters:
- name: kubernetes

Change to:

clusters:
- name: prod-k8s.xyz

Also update the context:

contexts:
- name: prod-k8s.xyz-admin
  context:
    cluster: prod-k8s.xyz
    user: kubernetes-admin

This DOES NOT modify the cluster internally—it only changes kubeconfig display.

✔ Works ✔ No downtime ❌ Does not change internal kubeadm cluster name

---

🅲️ Full Reinstall (Only if You Want Clean & Correct Setup)

During kubeadm init, you can set:

sudo kubeadm init \
  --control-plane-endpoint=prod-k8s.xyz \
  --node-name=prod-k8s.xyz \
  --config kubeadm-config.yaml

In kubeadm-config.yaml:

clusterName: prod-k8s.xyz
apiServer:
  certSANs:
  - prod-k8s.xyz

This gives the cleanest result.

---

⚡ SUMMARY

Method	Changes Internal Cluster Name?	Changes Kubeconfig?	Risk
A. kubeadm reconfigure (recommended)	✔ Yes	✔ Yes	Low
B. Manual kubeconfig edit	❌ No	✔ Yes	None
C. Reinstall (cleanest)	✔ Yes	✔ Yes	Medium/High

---

kube-public is one of the three system namespaces Kubernetes creates automatically:

• kube-system

• kube-public

• kube-node-lease

Among these, kube-public is the only namespace that is readable by everyone (unauthenticated access).

---

✅ Purpose of kube-public Namespace

1. Publicly readable, cluster-wide information

Kubernetes uses kube-public for storing information that should be accessible to all users, including those who are not authenticated.

This is mainly for:

• Bootstrapping new clients

• Sharing cluster-level public data

• Testing access

Kubernetes defines an RBAC rule allowing unauthenticated read access to this namespace.

---

What is stored there by default?

Typically only one important ConfigMap:

📌 kube-public/cluster-info ConfigMap

kubectl get configmap -n kube-public cluster-info -o yaml

This contains public cluster configuration, such as:

• Public CA certificate

• API server endpoint

• Information required for kubeadm join

It helps worker nodes bootstrap securely.

---

Why keep it public?

Because:

• Joining nodes need the cluster's CA cert

• Users who need kubeconfig may read public CA

• During bootstrap, unauthenticated clients cannot yet authenticate

So Kubernetes makes this namespace globally readable but not writable.

---

Security Implications

✔ Safe — it contains only public data ❌ Do NOT store secrets here ✔ Kubernetes protects it: only admins can write inside it

---

Summary

Namespace	Purpose
kube-system	System pods (kube-dns, controller-manager, scheduler, CNI)
kube-public	Public, read-only cluster info (CA cert, cluster-info)
kube-node-lease	Heartbeats and node leases

---

Typical usage (admins):

kubectl get cm -n kube-public
kubectl describe cm cluster-info -n kube-public