- Go 82.4%
- Gherkin 8%
- Shell 5.8%
- Dockerfile 2%
- Starlark 1.8%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
125f30e68a
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 4.39.1 to 4.39.2. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/v4.39.1...v4.39.2) --- updated-dependencies: - dependency-name: github/codeql-action dependency-version: 4.39.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> |
||
| .github | ||
| build | ||
| cmd | ||
| controller/certificatesigningrequest | ||
| deploy | ||
| e2e | ||
| hack | ||
| logger | ||
| metrics | ||
| .dockerignore | ||
| .gitattributes | ||
| .gitignore | ||
| .golangci.yml | ||
| .grype.yaml | ||
| .nancy-ignore | ||
| CHANGELOG.md | ||
| codecov.yml | ||
| CONTRIBUTING.md | ||
| Dockerfile | ||
| go.mod | ||
| go.sum | ||
| LICENSE | ||
| main.go | ||
| README.md | ||
| Tiltfile | ||
Kubelet Serving Certificate Approver
Kubelet Serving Certificate Approver is a custom approving controller which approves kubernetes.io/kubelet-serving Certificate Signing Request that kubelet use to serve TLS endpoints.
Why should I use Kubelet Serving Certificate Approver?
-
You want to securely - in terms of trusted Certificate Authoritity (CA) - reach kubelet endpoint
-
Signed serving certificates are honored as a valid kubelet serving certificate by the API server
-
Don't want to use
--kubelet-insecure-tlsflag during installation of metrics-server
Do I need to have a commercial certificate?
No. Every Kubernetes cluster has a Cluster Root Certificate Authority (CA).
How do I use Kubelet Serving Certificate Approver?
To install into your Kubernetes cluster, please navigate to deploy directory.
Note: your Kubernetes cluster must be configured with enabled TLS Bootstrapping and provided rotate-server-certificates: true kubelet argument.
Kubernetes Compatibility Matrix
For older Kubernetes versions (v1.19, v1.20, v1.21) please see older releases.
The consumed API has been stable since v1.22. However, E2E tests have been removed from the CI pipeline following the removal of the node-role.kubernetes.io/master toleration from the deployment. For more information, refer to KEP-2067.
| Version | Compatible |
|---|---|
v1.24 |
✓ |
v1.25 |
✓ |
v1.26 |
✓ |
v1.27 |
✓ |
v1.28 |
✓ |
v1.29 |
✓ |
v1.30 |
✓ |
v1.31 |
✓ |
v1.32 |
✓ |
v1.33 |
✓ |
v1.34 |
✓ |
v1.35 |
✓ |
v1.36 |
✓ |
Prometheus Metrics
You can download Prometheus metrics /metrics endpoint.
Custom Metrics
| Metric | Description |
|---|---|
kubelet_serving_cert_approver_approved_certificate_signing_request_count |
The number of approved Certificate Signing Request |
kubelet_serving_cert_approver_invalid_certificate_signing_request_count |
The number of invalid Certificate Signing Request |
Reference
- Original idea: https://github.com/kontena/kubelet-rubber-stamp which is unfortunately not maintained.
- Kubernetes TLS bootstrapping: https://kubernetes.io/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/
- Conformant Rules: https://kubernetes.io/docs/reference/access-authn-authz/certificate-signing-requests/#kubernetes-signers
License
Apache License, Version 2.0, see LICENSE.