
The AWS API requires a signature on method calls, including the timestamp to prevent replay attacks. A time drift of up to 5 minutes between client and server is tolerated. However, if the client clock drifts by >5 minutes, the server will start to reject API calls (with the cryptic "AWS was not able to validate the provided access credentials"). To prevent this happening, we install ntp on all nodes. Fix #11371
SaltStack configuration
This is the root of the SaltStack configuration for Kubernetes. A high level overview for the Kubernetes SaltStack configuration can be found in the docs tree.
This SaltStack configuration currently applies to default
configurations for Debian-on-GCE, Fedora-on-Vagrant, Ubuntu-on-AWS and
Ubuntu-on-Azure. (That doesn't mean it can't be made to apply to an
arbitrary configuration, but those are only the in-tree OS/IaaS
combinations supported today.) As you peruse the configuration, these
are shorthanded as gce
, vagrant
, aws
, azure
in grains.cloud
;
the documentation in this tree uses this same shorthand for convenience.
See more: