You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Siegfried Weber e77fd18270 Sign CSRs for kubelet-serving with the server CA ... Problem: Only the client CA is passed to the kube-controller-manager and therefore CSRs with the signer name "kubernetes.io/kubelet-serving" are signed with the client CA. Serving certificates must be signed with the server CA otherwise e.g. "kubectl logs" fails with the error message "x509: certificate signed by unknown authority". Solution: Instead of providing only one CA via the kube-controller-manager parameter "--cluster-signing-cert-file", the corresponding CA for every signer is set with the parameters "--cluster-signing-kube-apiserver-client-cert-file", "--cluster-signing-kubelet-client-cert-file", "--cluster-signing-kubelet-serving-cert-file", and "--cluster-signing-legacy-unknown-cert-file". Signed-off-by: Siegfried Weber <mail@siegfriedweber.net>		4 years ago
..
agent	Add support for dual-stack Pod/Service CIDRs and node IP addresses (#3212)	4 years ago
config	Add support for dual-stack Pod/Service CIDRs and node IP addresses (#3212)	4 years ago
control	Sign CSRs for kubelet-serving with the server CA	4 years ago
executor	Add tombstone file to etcd and catch errc etcd channel (#2592)	4 years ago