Document kubernetes.io/kube-apiserver-serving ClusterTrustBundle signer #48492

stlaz · 2024-10-22T09:10:54Z

Description

This is ~~a placeholder~~ for KEP-3257 Cluster Trust Bundles

Issue

Related to: kubernetes/enhancements#3257

netlify · 2024-10-22T09:11:13Z

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

Name	Link
🔨 Latest commit	`ad05ff8`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-vnext-staging/deploys/674714996a54c400089b9d79

netlify · 2024-10-22T09:21:53Z

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`4304cc1`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/67a380f97f15220008a4b70c
😎 Deploy Preview	https://deploy-preview-48492--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

spurin · 2024-11-01T12:20:33Z

Hello @stlaz 👋 please take a look at Documenting for a release - PR Ready for Review to get your PR ready for review before Tuesday November 19th 2024 18:00 PST. Thank you!

sftim · 2024-11-15T11:24:26Z

/retitle Document kubernetes.io/kube-apiserver-serving ClusterTrustBundle signer

sftim

Some feedback

content/en/docs/reference/access-authn-authz/certificate-signing-requests.md

content/en/docs/reference/command-line-tools-reference/feature-gates/cluster-trust-bundle.md

content/en/docs/reference/access-authn-authz/certificate-signing-requests.md

stlaz · 2024-11-25T10:55:34Z

Thank you @sftim for the review. I addressed your comments, I had additional questions with some of them.

content/en/docs/reference/glossary/san.md

content/en/docs/reference/command-line-tools-reference/feature-gates/cluster-trust-bundle.md

sftim · 2024-11-27T12:36:05Z

LGTM for docs (even with pending feedback)
We should try to get a technical review on this change as well.

stlaz · 2024-11-27T12:48:10Z

Thank you for the review, I applied your suggestions, modifying some slightly.

@enj @ahmedtd would you please do the technical review?

enj

Minor comments, LGTM.

enj · 2025-01-14T20:02:28Z

content/en/docs/reference/command-line-tools-reference/feature-gates/cluster-trust-bundle.md

@@ -10,4 +10,9 @@ stages:
    defaultValue: false
    fromVersion: "1.27"
 ---
-Enable ClusterTrustBundle objects and kubelet integration.
+Enable ClusterTrustBundle support, including kubelet integration. Also makes the Kubernetes


I think we need to indicate that the ClusterTrustBundle feature gate is used in API server, controller manager and kubelet.

kubelet uses only the ClusterTrustBundleProjection fg, I'll add the info about KAS and KCM.

I wonder if we wanted to clarify that the kubelet integration needs to be additionally set up with its own featuregate that depends on the API this featuregate enables?

Also, I just realized the mention of kubelet is likely all wrong here, I'll remove that. The ClusterTrustBundleProjection FG controls the availability of the pod fields AFAIK.

enj · 2025-01-14T20:06:58Z

content/en/docs/reference/access-authn-authz/certificate-signing-requests.md

+    1. Permitted x509 extensions - honors subjectAltName and key usage extensions. At
+       least one DNS or IP subjectAltName must be present. The SAN DNS/IP of the certificates
+       must resolve/point to kube-apiserver's hostname/IP.
+    1. Permitted key usages - ["key encipherment", "digital signature", "server auth"] or ["digital signature", "server auth"].


But we don't fail anything if you have more than these though right?

There's little to no validation around the KAS serving cert today, so no, we don't 😐

benjaminapetersen · 2025-01-15T16:07:46Z

/assign @enj

sftim · 2025-01-31T00:33:14Z

@stlaz is this targeting the right branch? Kubernetes v1.32 is released, so I imagine you want to target main.

sftim · 2025-01-31T00:33:34Z

/hold

pending a switch to a valid base branch

stlaz · 2025-01-31T14:29:01Z

Indeed, this was created for 1.32 originally but that's now main. Switched to the correct one, I'll fix the merge conflicts to make the PR mergeable again.

k8s-ci-robot · 2025-02-05T15:17:18Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign tengqm for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

content/en/docs/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-triage-robot · 2025-05-06T15:28:17Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

stlaz · 2025-05-07T14:32:05Z

/remove-lifecycle stale

k8s-ci-robot added this to the 1.32 milestone Oct 22, 2024

k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Oct 22, 2024

stlaz force-pushed the cluster_trust_bundles branch from f6fe71b to b3c06b7 Compare November 12, 2024 13:10

k8s-ci-robot added language/en Issues or PRs related to English language size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Nov 12, 2024

stlaz changed the title ~~KEP-3257 (Cluster Trust Bundles) docs placeholder~~ KEP-3257 (Cluster Trust Bundles): add docs for a new signer Nov 12, 2024

stlaz marked this pull request as ready for review November 12, 2024 13:12

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Nov 12, 2024

k8s-ci-robot requested review from divya-mohan0209 and enj November 12, 2024 13:12

k8s-ci-robot changed the title ~~KEP-3257 (Cluster Trust Bundles): add docs for a new signer~~ Document kubernetes.io/kube-apiserver-serving ClusterTrustBundle signer Nov 15, 2024

sftim reviewed Nov 15, 2024

View reviewed changes

content/en/docs/reference/access-authn-authz/certificate-signing-requests.md Outdated Show resolved Hide resolved

stlaz force-pushed the cluster_trust_bundles branch from b3c06b7 to 7687889 Compare November 25, 2024 10:53

k8s-ci-robot added size/M Denotes a PR that changes 30-99 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Nov 25, 2024

stlaz force-pushed the cluster_trust_bundles branch from 7687889 to 58c17dd Compare November 25, 2024 14:05

sftim reviewed Nov 27, 2024

View reviewed changes

content/en/docs/reference/glossary/san.md Outdated Show resolved Hide resolved

sftim reviewed Nov 27, 2024

View reviewed changes

content/en/docs/reference/glossary/san.md Outdated Show resolved Hide resolved

sftim reviewed Nov 27, 2024

View reviewed changes

content/en/docs/reference/glossary/san.md Outdated Show resolved Hide resolved

sftim reviewed Nov 27, 2024

View reviewed changes

content/en/docs/reference/command-line-tools-reference/feature-gates/cluster-trust-bundle.md Outdated Show resolved Hide resolved

stlaz force-pushed the cluster_trust_bundles branch from 58c17dd to ad05ff8 Compare November 27, 2024 12:46

enj reviewed Jan 14, 2025

View reviewed changes

k8s-ci-robot assigned enj Jan 15, 2025

stlaz force-pushed the cluster_trust_bundles branch from 2976832 to 131eee4 Compare January 20, 2025 13:44

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jan 31, 2025

stlaz changed the base branch from dev-1.32 to main January 31, 2025 14:27

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 31, 2025

stlaz added 2 commits February 5, 2025 16:16

KEP-3257 (Cluster Trust Bundles): add a new signer

987f007

review: split the CTB FG info for KAS and KCM

4304cc1

stlaz force-pushed the cluster_trust_bundles branch from 131eee4 to 4304cc1 Compare February 5, 2025 15:17

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Feb 5, 2025

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 6, 2025

k8s-ci-robot removed the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label May 7, 2025

Document kubernetes.io/kube-apiserver-serving ClusterTrustBundle signer #48492

Are you sure you want to change the base?

Document kubernetes.io/kube-apiserver-serving ClusterTrustBundle signer #48492

Uh oh!

Conversation

stlaz commented Oct 22, 2024 • edited by sftim Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Issue

Uh oh!

netlify bot commented Oct 22, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

Uh oh!

netlify bot commented Oct 22, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Pull request preview available for checking

Uh oh!

spurin commented Nov 1, 2024

Uh oh!

sftim commented Nov 15, 2024

Uh oh!

sftim left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

stlaz commented Nov 25, 2024

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sftim commented Nov 27, 2024

Uh oh!

stlaz commented Nov 27, 2024

Uh oh!

enj left a comment

Choose a reason for hiding this comment

Uh oh!

enj Jan 14, 2025

Choose a reason for hiding this comment

Uh oh!

stlaz Jan 20, 2025

Choose a reason for hiding this comment

Uh oh!

stlaz Jan 20, 2025

Choose a reason for hiding this comment

Uh oh!

enj Jan 14, 2025

Choose a reason for hiding this comment

Uh oh!

stlaz Jan 20, 2025

Choose a reason for hiding this comment

Uh oh!

benjaminapetersen commented Jan 15, 2025

Uh oh!

sftim commented Jan 31, 2025

Uh oh!

sftim commented Jan 31, 2025

Uh oh!

stlaz commented Jan 31, 2025

Uh oh!

k8s-ci-robot commented Feb 5, 2025

Uh oh!

k8s-triage-robot commented May 6, 2025

Uh oh!

stlaz commented May 7, 2025

Uh oh!

Uh oh!

stlaz commented Oct 22, 2024 •

edited by sftim

Loading

netlify bot commented Oct 22, 2024 •

edited

Loading

netlify bot commented Oct 22, 2024 •

edited

Loading