{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/82952","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/82952/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/82952/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/82952/events","html_url":"https://github.com/kubernetes/kubernetes/issues/82952","id":496548423,"node_id":"MDU6SXNzdWU0OTY1NDg0MjM=","number":82952,"title":"CertificateSigningRequest and the root CA pubkey","user":{"login":"costinm","id":84202,"node_id":"MDQ6VXNlcjg0MjAy","avatar_url":"https://avatars1.githubusercontent.com/u/84202?v=4","gravatar_id":"","url":"https://api.github.com/users/costinm","html_url":"https://github.com/costinm","followers_url":"https://api.github.com/users/costinm/followers","following_url":"https://api.github.com/users/costinm/following{/other_user}","gists_url":"https://api.github.com/users/costinm/gists{/gist_id}","starred_url":"https://api.github.com/users/costinm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/costinm/subscriptions","organizations_url":"https://api.github.com/users/costinm/orgs","repos_url":"https://api.github.com/users/costinm/repos","events_url":"https://api.github.com/users/costinm/events{/privacy}","received_events_url":"https://api.github.com/users/costinm/received_events","type":"User","site_admin":false},"labels":[{"id":267761362,"node_id":"MDU6TGFiZWwyNjc3NjEzNjI=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/feature","name":"kind/feature","color":"c7def8","default":false},{"id":617149945,"node_id":"MDU6TGFiZWw2MTcxNDk5NDU=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/needs-sig","name":"needs-sig","color":"ededed","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2019-09-20T21:11:17Z","updated_at":"2019-09-27T19:53:12Z","closed_at":"2019-09-26T14:17:36Z","author_association":"NONE","body":"https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/\r\n\r\nThe note mentions that the CA that sings the CertificateSigningRequest may be different than the cluster CA. Typically ( at least on GKE ) the clusterCA is used.\r\n\r\nThis creates a number of problems:\r\n- there is no way (that I found) to identify which CA signed the certificate. The signed certificate has the SHA of the public key of the root CA - but not the full public key ( it is not a chain, \r\njust the leaf cert)\r\n\r\n- distribution of such key is problematic - creating a configmap in each namespace requires RBAC permissions, mounting, etc.\r\n\r\n\r\n**What would you like to be added**:\r\n\r\nKubelet distributes the apiserver CA in a well-known location. If the Cluster signing public key is different from the cluster, it should be provided in a similar fashion. One option is to have \r\nthe set of public keys in the same well-known location (bundle), which may also help in cases\r\nof root cert rotation. \r\n\r\nAlternatively, the CA used by CertificateSigningRequest should also be used to sign the apiserve key ( possibly via an intermediate), and be the only CA that is distributed by kubelet.\r\n\r\nAlternatively, the doc should be updated to remove the option of having 2 different root CAs.\r\n\r\n**Why is this needed**:\r\n\r\nAs is I don't think the API is usable except in cases where 'dedicated' CA different from cluster CA is used. \r\n\r\nWe are planning to use this API in Istio - to simplify the bootstrap and TLS for control plane - but\r\nit won't work for dedicated CA. I assume most K8S installs use the same CA and it might not be a big issue, we  could test at install if the cluster CA matches and not support clusters with 'dedicated' CA.\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/536075427","html_url":"https://github.com/kubernetes/kubernetes/issues/82952#issuecomment-536075427","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/82952","id":536075427,"node_id":"MDEyOklzc3VlQ29tbWVudDUzNjA3NTQyNw==","user":{"login":"costinm","id":84202,"node_id":"MDQ6VXNlcjg0MjAy","avatar_url":"https://avatars1.githubusercontent.com/u/84202?v=4","gravatar_id":"","url":"https://api.github.com/users/costinm","html_url":"https://github.com/costinm","followers_url":"https://api.github.com/users/costinm/followers","following_url":"https://api.github.com/users/costinm/following{/other_user}","gists_url":"https://api.github.com/users/costinm/gists{/gist_id}","starred_url":"https://api.github.com/users/costinm/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/costinm/subscriptions","organizations_url":"https://api.github.com/users/costinm/orgs","repos_url":"https://api.github.com/users/costinm/repos","events_url":"https://api.github.com/users/costinm/events{/privacy}","received_events_url":"https://api.github.com/users/costinm/received_events","type":"User","site_admin":false},"created_at":"2019-09-27T19:53:12Z","updated_at":"2019-09-27T19:53:12Z","author_association":"NONE","body":"Then document that the CSR API is not meant for user-space components and should be used only by kubelet. \r\n\r\nRight now there is nothing that I've seen that mark the CRD as internal-only.  "}}
{"actor":{"display_login":"costinm"}}