{"action":"created","issue":{"url":"https://api.github.com/repos/openshift/cluster-kube-controller-manager-operator/issues/113","repository_url":"https://api.github.com/repos/openshift/cluster-kube-controller-manager-operator","labels_url":"https://api.github.com/repos/openshift/cluster-kube-controller-manager-operator/issues/113/labels{/name}","comments_url":"https://api.github.com/repos/openshift/cluster-kube-controller-manager-operator/issues/113/comments","events_url":"https://api.github.com/repos/openshift/cluster-kube-controller-manager-operator/issues/113/events","html_url":"https://github.com/openshift/cluster-kube-controller-manager-operator/pull/113","id":392074572,"node_id":"MDExOlB1bGxSZXF1ZXN0MjM5NDI0MDg2","number":113,"title":"Revert \"Include kube-ca in client-ca bundle\"","user":{"login":"sttts","id":730123,"node_id":"MDQ6VXNlcjczMDEyMw==","avatar_url":"https://avatars0.githubusercontent.com/u/730123?v=4","gravatar_id":"","url":"https://api.github.com/users/sttts","html_url":"https://github.com/sttts","followers_url":"https://api.github.com/users/sttts/followers","following_url":"https://api.github.com/users/sttts/following{/other_user}","gists_url":"https://api.github.com/users/sttts/gists{/gist_id}","starred_url":"https://api.github.com/users/sttts/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sttts/subscriptions","organizations_url":"https://api.github.com/users/sttts/orgs","repos_url":"https://api.github.com/users/sttts/repos","events_url":"https://api.github.com/users/sttts/events{/privacy}","received_events_url":"https://api.github.com/users/sttts/received_events","type":"User","site_admin":false},"labels":[{"id":1064873905,"node_id":"MDU6TGFiZWwxMDY0ODczOTA1","url":"https://api.github.com/repos/openshift/cluster-kube-controller-manager-operator/labels/approved","name":"approved","color":"0ffa16","default":false},{"id":1068771154,"node_id":"MDU6TGFiZWwxMDY4NzcxMTU0","url":"https://api.github.com/repos/openshift/cluster-kube-controller-manager-operator/labels/do-not-merge/hold","name":"do-not-merge/hold","color":"e11d21","default":false},{"id":1067218787,"node_id":"MDU6TGFiZWwxMDY3MjE4Nzg3","url":"https://api.github.com/repos/openshift/cluster-kube-controller-manager-operator/labels/lgtm","name":"lgtm","color":"15dd18","default":false},{"id":1064427759,"node_id":"MDU6TGFiZWwxMDY0NDI3NzU5","url":"https://api.github.com/repos/openshift/cluster-kube-controller-manager-operator/labels/size/XS","name":"size/XS","color":"009900","default":false}],"state":"open","locked":false,"assignee":{"login":"mfojtik","id":44136,"node_id":"MDQ6VXNlcjQ0MTM2","avatar_url":"https://avatars2.githubusercontent.com/u/44136?v=4","gravatar_id":"","url":"https://api.github.com/users/mfojtik","html_url":"https://github.com/mfojtik","followers_url":"https://api.github.com/users/mfojtik/followers","following_url":"https://api.github.com/users/mfojtik/following{/other_user}","gists_url":"https://api.github.com/users/mfojtik/gists{/gist_id}","starred_url":"https://api.github.com/users/mfojtik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mfojtik/subscriptions","organizations_url":"https://api.github.com/users/mfojtik/orgs","repos_url":"https://api.github.com/users/mfojtik/repos","events_url":"https://api.github.com/users/mfojtik/events{/privacy}","received_events_url":"https://api.github.com/users/mfojtik/received_events","type":"User","site_admin":false},"assignees":[{"login":"mfojtik","id":44136,"node_id":"MDQ6VXNlcjQ0MTM2","avatar_url":"https://avatars2.githubusercontent.com/u/44136?v=4","gravatar_id":"","url":"https://api.github.com/users/mfojtik","html_url":"https://github.com/mfojtik","followers_url":"https://api.github.com/users/mfojtik/followers","following_url":"https://api.github.com/users/mfojtik/following{/other_user}","gists_url":"https://api.github.com/users/mfojtik/gists{/gist_id}","starred_url":"https://api.github.com/users/mfojtik/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mfojtik/subscriptions","organizations_url":"https://api.github.com/users/mfojtik/orgs","repos_url":"https://api.github.com/users/mfojtik/repos","events_url":"https://api.github.com/users/mfojtik/events{/privacy}","received_events_url":"https://api.github.com/users/mfojtik/received_events","type":"User","site_admin":false}],"milestone":null,"comments":3,"created_at":"2018-12-18T09:50:26Z","updated_at":"2018-12-18T10:00:49Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/openshift/cluster-kube-controller-manager-operator/pulls/113","html_url":"https://github.com/openshift/cluster-kube-controller-manager-operator/pull/113","diff_url":"https://github.com/openshift/cluster-kube-controller-manager-operator/pull/113.diff","patch_url":"https://github.com/openshift/cluster-kube-controller-manager-operator/pull/113.patch"},"body":"Reverts openshift/cluster-kube-controller-manager-operator#112\r\n\r\nThe kube-ca has to be served as part of the server certs. This is the case for the apiserver (otherwise, more would have been broken). For some reason the cadvisor does not serve it, which broke @s-urbaniak's use-case.\r\n\r\nI don't think it is right to distribute the kube-ca through the whole cluster as part of some CA bundle. Being part of the server certs is the right approach instead.\r\n\r\nIndependently, it is questionably why the service account ca.crt is the right CA to be used against the cadvisor in the first place. That CA is meant for the apiserver, and just happens to match other services on the node.\r\n\r\n@sjenning can you comment?"},"comment":{"url":"https://api.github.com/repos/openshift/cluster-kube-controller-manager-operator/issues/comments/448164367","html_url":"https://github.com/openshift/cluster-kube-controller-manager-operator/pull/113#issuecomment-448164367","issue_url":"https://api.github.com/repos/openshift/cluster-kube-controller-manager-operator/issues/113","id":448164367,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0ODE2NDM2Nw==","user":{"login":"s-urbaniak","id":375856,"node_id":"MDQ6VXNlcjM3NTg1Ng==","avatar_url":"https://avatars1.githubusercontent.com/u/375856?v=4","gravatar_id":"","url":"https://api.github.com/users/s-urbaniak","html_url":"https://github.com/s-urbaniak","followers_url":"https://api.github.com/users/s-urbaniak/followers","following_url":"https://api.github.com/users/s-urbaniak/following{/other_user}","gists_url":"https://api.github.com/users/s-urbaniak/gists{/gist_id}","starred_url":"https://api.github.com/users/s-urbaniak/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/s-urbaniak/subscriptions","organizations_url":"https://api.github.com/users/s-urbaniak/orgs","repos_url":"https://api.github.com/users/s-urbaniak/repos","events_url":"https://api.github.com/users/s-urbaniak/events{/privacy}","received_events_url":"https://api.github.com/users/s-urbaniak/received_events","type":"User","site_admin":false},"created_at":"2018-12-18T10:00:49Z","updated_at":"2018-12-18T10:00:49Z","author_association":"CONTRIBUTOR","body":"agreed :+1: having the kube-ca intermediate served by the cadvisor endpoint is the better approach. Let's hold this until the cadvisor patch lands."}}
{"actor":{"display_login":"s-urbaniak"}}