KeyEncipherment usage should not be required for non-RSA kubelet client/serving CSRs

[liggitt]

What happened?

golang/go#36499 describes why the KeyEncipherment extended key usage does not make sense (and in some cases, is not allowed) for ECDSA keys.

The Kubernetes kubernetes.io/kubelet-serving and kubernetes.io/kube-apiserver-client-kubelet signer names require a key encipherment usage.

If the kubelet is not using an RSA key (which it does not by default), it should not need to specify this key usage.

Since relaxing this to make the key encipherment usage optional for those two signerNames may involve an API validation change, this may need rollout over 2 releases. The places we'll need to make sure work properly are:

1. API validation of CSR create and update requests
2. Controller tolerating CSR objects with/without that usage
3. Kubelets requesting CSRs properly without that usage if given a non-RSA key

What did you expect to happen?

n/a

How can we reproduce it (as minimally and precisely as possible)?

n/a

Anything else we need to know?

No response

Kubernetes version

$ kubectl version
# paste output here

Cloud provider

OS version

# On Linux:
$ cat /etc/os-release
# paste output here
$ uname -a
# paste output here

# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here

Install tools

Container runtime (CRI) and version (if applicable)

Related plugins (CNI, CSI, ...) and versions (if applicable)

[liggitt]

/sig auth

[ritazh]

/triage accepted

[hosseinsalahi]

Hey @liggitt, Bug-Triage here!
There hasn't been any activity on this issue for a couple of months now. Just want to make sure this issue is still on track for the 1.25?

[liggitt]

no one has picked it up, but it remains important

[pacoxu]

/assign
I will take a look next week.

[pacoxu]

milestone v1.25 task was done. We can tag this to be milestone v1.26 now.

[cailynse]

Hello @pacoxu! Bug Triage shadow here - I wanted to check in and see if this issue is still on track for 1.26?

[pacoxu]

Hello @pacoxu! Bug Triage shadow here - I wanted to check in and see if this issue is still on track for 1.26?

Yes. I will follow up #111660 later, and there are still CI failures to be fixed.