kubeadm: generate a client certificate with "system:masters" in a separate file

[neolit123]

Enhancement Description

• One-line enhancement description (can be used as a release note): Don't bind the admin.conf user to system:masters in kubeadm. Create a separate conf file with the super user group and generate it on kubeadm init.
• Kubernetes Enhancement Proposal: https://git.k8s.io/enhancements/keps/sig-cluster-lifecycle/kubeadm/4214-separate-super-user-kubeconfig
• Discussion Link: Feature Reqest: Don't bind the admin.conf user to system:masters kubeadm#2414
• Primary contact (assignee): @neolit123
• Responsible SIGs: Cluster Lifecycle
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): -
  • Beta release target (x.y): -
  • Stable release target (x.y): 1.29 (graduates directly)

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

kubernetes/kubeadm#2414

KEP file changes:

• kubeadm: add KEP 4214 for separate super-user kubeconfig #4218
• keps/../kubeadm: 4214: revisit test plan and risks/mitigations #4302

[npolshakova]

Hello @neolit123, 1.29 Enhancements team here! Is this enhancement targeting 1.29? If it is, can you follow the instructions here to opt in the enhancements and make sure the lead-opted-in label is set so it can get added to the tracking board? Thanks!

[neolit123]

Hello @neolit123, 1.29 Enhancements team here! Is this enhancement targeting 1.29? If it is, can you follow the instructions here to opt in the enhancements and make sure the lead-opted-in label is set so it can get added to the tracking board? Thanks!

hi, is it possible to not opt-in into the enhancement tracking? asking as a sig lead.

[npolshakova]

Yep, currently this enhancement is not being tracked in the 1.29 enhancements tracking project board. If that's the intention, you don't need to change anything. You've set the milestone as 1.29 so I wanted to double check you didn't intend it to be tracked for 1.29.

[neolit123]

If that's the intention, you don't need to change anything.

yes, preferably. we do all the docs / e2e / code tracking changes ourself as kubeadm is a relatively small project.