From 3e839ef9639a422a2cc93676689293f4bf00ef17 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cl=C3=A9ment=20Nussbaumer?= Date: Fri, 17 Dec 2021 09:59:46 +0100 Subject: [PATCH 1/2] docs: add link to a new kubelet csr approver --- .../en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md index 676e5f7643..ce20f173ba 100644 --- a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md +++ b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md @@ -283,6 +283,7 @@ the node identity with an out of band mechanism. {{% thirdparty-content %}} Third party custom controllers can be used: +- [kubelet-csr-approver](https://github.com/postfinance/kubelet-csr-approver) - [kubelet-rubber-stamp](https://github.com/kontena/kubelet-rubber-stamp) Such a controller is not a secure mechanism unless it not only verifies the CommonName From 65eaccecf572b213d6a8025c5ea937775dd5a788 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Cl=C3=A9ment=20Nussbaumer?= Date: Mon, 20 Dec 2021 14:10:13 +0100 Subject: [PATCH 2/2] remove kubeler-rubber-stamp Due to it not being compatible with K8s 1.22 anymore and not being maintained either --- .../en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md | 1 - 1 file changed, 1 deletion(-) diff --git a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md index ce20f173ba..094b7a767a 100644 --- a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md +++ b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md @@ -284,7 +284,6 @@ the node identity with an out of band mechanism. Third party custom controllers can be used: - [kubelet-csr-approver](https://github.com/postfinance/kubelet-csr-approver) -- [kubelet-rubber-stamp](https://github.com/kontena/kubelet-rubber-stamp) Such a controller is not a secure mechanism unless it not only verifies the CommonName in the CSR but also verifies the requested IPs and domain names. This would prevent