New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
kubeadm: deprecate the flag --use-api for cert renewal #88827
kubeadm: deprecate the flag --use-api for cert renewal #88827
Conversation
The KCM is moving to means of only singing apiserver (kubelet) client and kubelet serving certificates. See: https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/20190607-certificates-api.md#signers Up until now the experimental kubeadm functionality '--use-api' under "kubeadm alpha certs renew" was using the KCM to sign *any* certficate as long as the KCM has the root CA cert/key. Post discussions with the kubeadm maintainers, it was decided that this functionality should be removed from kubeadm due to the requirement to have external signers for renewing the common control-plane certificates that kubeadm manages.
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: neolit123 The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
/hold |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks @neolit123 !
/lgtm
/hold cancel |
What this PR does / why we need it:
The KCM is moving to means of only singing apiserver (kubelet) client
and kubelet serving certificates. See:
https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/20190607-certificates-api.md#signers
Up until now the experimental kubeadm functionality '--use-api'
under "kubeadm alpha certs renew" was using the KCM to sign any
certficate as long as the KCM has the root CA cert/key.
Post discussions with the kubeadm maintainers, it was decided that
this functionality should be removed from kubeadm due to the
requirement to have external signers for renewing the common
control-plane certificates that kubeadm manages.
Which issue(s) this PR fixes:
ref kubernetes/kubeadm#2047
Special notes for your reviewer:
NONE
Does this PR introduce a user-facing change?:
Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:
/assign @fabriziopandini @rosti
/kind deprecation
/priority important-soon