certificates.md: add note about system:masters in apiserver cert #43870
Conversation
k8s-ci-robot
added
cncf-cla: yes
k8s-ci-robot
added
language/en
k8s-ci-robot
added
size/XXL
✅ Pull request preview available for checkingBuilt without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify site configuration. |
neolit123
force-pushed
the
1.29-fix-system-masters-apiserver-kubelet-cert
branch
from
0ae8958
to
b957213
Compare
👷 Deploy Preview for kubernetes-io-vnext-staging processing.
|
k8s-ci-robot
added
size/XS
The kube-apiserver flag --kubelet-client-certificate accepts a client certificate (kube-apiserver-kubelet-client.crt) to connect to the kubelet. There is no need for this certificate to have "system:masters" as "O" in the Subject, instead it can be a less privileged group like kubeadm's "kubeadm:cluster-admins".
neolit123
force-pushed
the
1.29-fix-system-masters-apiserver-kubelet-cert
branch
from
b957213
to
ddb784a
Compare
neolit123
changed the title
|
Nice. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: tengqm The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
| Instead of using the super-user group `system:masters` for `kube-apiserver-kubelet-client` | ||
| a less privileged group can be used. kubeadm uses the `kubeadm:cluster-admins` group for | ||
| that purpose. | ||
| {{< /note >}} |
There was a problem hiding this comment.
/lgtm
A question: Should we mention the behavior changed version v1.29 like the feature gate note?
There was a problem hiding this comment.
you mean the super-admin.conf feature in 1.29?
it was added without a feature gate.
There was a problem hiding this comment.
you mean the super-admin.conf feature in 1.29?
I mean this note is since v1.29.
- For other FGs, we may have a tag note there to show this is alpha/beta since v1.xx.
There was a problem hiding this comment.
well, this PR merges in the dev-1.29 branch and we don't have to do anything else, AFAIK.
the docs are versioned, so if users are on 1.28 they should be looking at 1.28 docs not at 1.29.
There was a problem hiding this comment.
i don't know what are the rules about these tags / notes
k8s-ci-robot
added
the
lgtm
|
LGTM label has been added. Git tree hash: d508030a1d7e97ea79402750c92ab4693386bbf6
|
The kube-apiserver flag --kubelet-client-certificate
accepts a client certificate (kube-apiserver-kubelet-client.crt)
to connect to the kubelet. There is no need for this certificate
to have "system:masters" as "O" in the Subject, instead it
can be a less privileged group like kubeadm's "kubeadm:cluster-admins".
k/k bugfix PR:
kubernetes/kubernetes#121837