Skip to content

K
k3s
Switch branch/tag
  1. 09 Jul, 2021 1 commit
  3. 08 Jul, 2021 2 commits
    • Siegfried Weber's avatar
      Sign CSRs for kubelet-serving with the server CA · 2b2f3182
      Siegfried Weber authored 
      Problem:
Only the client CA is passed to the kube-controller-manager and
therefore CSRs with the signer name "kubernetes.io/kubelet-serving" are
signed with the client CA. Serving certificates must be signed with the
server CA otherwise e.g. "kubectl logs" fails with the error message
"x509: certificate signed by unknown authority".

Solution:
Instead of providing only one CA via the kube-controller-manager
parameter "--cluster-signing-cert-file", the corresponding CA for every
signer is set with the parameters
"--cluster-signing-kube-apiserver-client-cert-file",
"--cluster-signing-kubelet-client-cert-file",
"--cluster-signing-kubelet-serving-cert-file", and
"--cluster-signing-legacy-unknown-cert-file".
Signed-off-by: 's avatarSiegfried Weber <mail@siegfriedweber.net>
(cherry picked from commit e77fd182)
      2b2f3182
    • Ricardo Weir's avatar
      [release-1.20] Update coredns (#3541) · f8311d6f
      Ricardo Weir authored 
      * Update coredns from 1.6.9 to 1.8.3
Signed-off-by: 's avatarRicardo Weir <ricardo.weir@suse.com>
      f8311d6f
  5. 30 Jun, 2021 1 commit
  7. 29 Jun, 2021 36 commits