whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #24418 from liggitt/tls-server

Browse Source 
Clarify external kubelet server approver requirements
This commit is contained in:
Kubernetes Prow Robot
2020-12-05 08:43:25 -08:00
committed by GitHub
parent 3208b29045 92f837d4b2
commit f06402e1d1
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping.md
+11
View File
@@ -415,6 +415,17 @@ approve node _serving_ certificates for [security
reasons](https://github.com/kubernetes/community/pull/1982). To use reasons](https://github.com/kubernetes/community/pull/1982). To use
`RotateKubeletServerCertificate` operators need to run a custom approving `RotateKubeletServerCertificate` operators need to run a custom approving
controller, or manually approve the serving certificate requests. controller, or manually approve the serving certificate requests.
A deployment-specific approval process for kubelet serving certificates should typically only approve CSRs which:
1. are requested by nodes (ensure the `spec.username` field is of the form
`system:node:<nodeName>` and `spec.groups` contains `system:nodes`)
2. request usages for a serving certificate (ensure `spec.usages` contains `server auth`,
optionally contains `digital signature` and `key encipherment`, and contains no other usages)
3. only have IP and DNS subjectAltNames that belong to the requesting node,
and have no URI and Email subjectAltNames (parse the x509 Certificate Signing Request
in `spec.request` to verify `subjectAltNames`)
{{< /note >}} {{< /note >}}
## Other authenticating components ## Other authenticating components