Document how to use Kubernetes with a custom certificate authority

[sdputurn]

What would you like to be added?

i would like k8s to use custom CA and it's key to sign certificates for apiserver, controller-manager, scheduler, kubelet etc.. and also sign CSR's.

i have checked the docs - https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#external-ca-mode

1. where it says to use external CA signed certificate for the server and add trust this CA in k8s(but this will k8s will not be able to sign CSR's)
2. it also says run the controller-manager standalone with --controllers=csrsigner and point to the CA certificate and key, but does not more details

we are looking at option 2. but the doc does not explain it well if this the option to use external CA and key to use for k8s.

thanks,
Sandeep

Why is this needed?

currently we have multiple cluster and every cluster usages it own CA for certificate management. Our scanning tools reports them as unknown CA. So we end up having so many CA to trust in scanning tool. we want to use a custom CA and use this CA cert and key in our k8s cluster.

[k8s-ci-robot]

There are no sig labels on this issue. Please add an appropriate label by using one of the following commands:

• /sig <group-name>
• /wg <group-name>
• /committee <group-name>

Please see the group list for a listing of the SIGs, working groups, and committees available.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[k8s-ci-robot]

This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[sdputurn]

wg /policy

[sftim]

This might be a documentation request. I think it is.

/retitle Document how to use Kubernetes with a custom certificate authority

[sftim]

/transfer website

[sftim]

/sig docs
/sig security
/sig auth

[aramase]

/triage accepted

[k8s-triage-robot]

This issue has not been updated in over 1 year, and should be re-triaged.

You can:

• Confirm that this issue is still relevant with /triage accepted (org members only)
• Close this issue with /close

For more details on the triage process, see https://www.kubernetes.dev/docs/guide/issue-triage/

/remove-triage accepted