From 92f837d4b2428052121e1b01cf498778a8069491 Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Wed, 7 Oct 2020 17:16:56 -0400 Subject: [PATCH] Clarify external kubelet server approver requirements --- .../kubelet-tls-bootstrapping.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/content/en/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping.md b/content/en/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping.md index 0daa490276..04aae60fa3 100644 --- a/content/en/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping.md +++ b/content/en/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping.md @@ -415,6 +415,17 @@ approve node _serving_ certificates for [security reasons](https://github.com/kubernetes/community/pull/1982). To use `RotateKubeletServerCertificate` operators need to run a custom approving controller, or manually approve the serving certificate requests. + +A deployment-specific approval process for kubelet serving certificates should typically only approve CSRs which: + +1. are requested by nodes (ensure the `spec.username` field is of the form + `system:node:` and `spec.groups` contains `system:nodes`) +2. request usages for a serving certificate (ensure `spec.usages` contains `server auth`, + optionally contains `digital signature` and `key encipherment`, and contains no other usages) +3. only have IP and DNS subjectAltNames that belong to the requesting node, + and have no URI and Email subjectAltNames (parse the x509 Certificate Signing Request + in `spec.request` to verify `subjectAltNames`) + {{< /note >}} ## Other authenticating components