kubeadm: generate a client certificate with "system:masters" in a separate file

kubernetes / enhancements

Enhancements tracking repo for Kubernetes

Apache License 2.0

3.33k stars 1.44k forks source link

kubeadm: generate a client certificate with "system:masters" in a separate file #4214

Closed neolit123 closed 2 months ago

neolit123 commented 9 months ago

Enhancement Description

One-line enhancement description (can be used as a release note): Don't bind the admin.conf user to system:masters in kubeadm. Create a separate conf file with the super user group and generate it on kubeadm init.
Kubernetes Enhancement Proposal: https://git.k8s.io/enhancements/keps/sig-cluster-lifecycle/kubeadm/4214-separate-super-user-kubeconfig
Discussion Link: https://github.com/kubernetes/kubeadm/issues/2414
Primary contact (assignee): @neolit123
Responsible SIGs: Cluster Lifecycle
Enhancement target (which target equals to which milestone):
- Alpha release target (x.y): -
- Beta release target (x.y): -
- Stable release target (x.y): 1.29 (graduates directly)

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

https://github.com/kubernetes/kubeadm/issues/2414

KEP file changes:

npolshakova commented 9 months ago

Hello @neolit123, 1.29 Enhancements team here! Is this enhancement targeting 1.29? If it is, can you follow the instructions here to opt in the enhancements and make sure the lead-opted-in label is set so it can get added to the tracking board? Thanks!

neolit123 commented 9 months ago

Hello @neolit123, 1.29 Enhancements team here! Is this enhancement targeting 1.29? If it is, can you follow the instructions here to opt in the enhancements and make sure the lead-opted-in label is set so it can get added to the tracking board? Thanks!

hi, is it possible to not opt-in into the enhancement tracking? asking as a sig lead.

npolshakova commented 9 months ago

Yep, currently this enhancement is not being tracked in the 1.29 enhancements tracking project board. If that's the intention, you don't need to change anything. You've set the milestone as 1.29 so I wanted to double check you didn't intend it to be tracked for 1.29.

neolit123 commented 9 months ago

If that's the intention, you don't need to change anything.

yes, preferably. we do all the docs / e2e / code tracking changes ourself as kubeadm is a relatively small project.

salehsedghpour commented 5 months ago

Hello 👋 1.30 Enhancements Lead here,

I'm closing milestone 1.29 now, If you wish to progress this enhancement in v1.30, please follow the instructions here to opt in the enhancement and make sure the lead-opted-in label is set so it can get added to the tracking board and finally add /milestone v1.30. Thanks!

/milestone clear

pacoxu commented 5 months ago

@SataQiu @neolit123 Is there other task for this feature after https://github.com/kubernetes/kubernetes/pull/122786 is merged?

neolit123 commented 5 months ago

no, that's the last PR we plan to merge.

k8s-triage-robot commented 2 months ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

Mark this issue as fresh with /remove-lifecycle stale
Close this issue with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

neolit123 commented 2 months ago

this is done