<p><em>[meta: there is more Kubernetes question activity here on SO than Serverfault so asking here even though it's not a programming question. Please flag for migration if asking here is inappropriate]</em></p>

<p><strong>Summary</strong>: How are kubelet certificates signed in Kops? At least in our environment they seem to be using a CA <em>per node</em>.</p>

<p><strong>Details</strong></p>

<p>Inspecting the SSL certs of a kubelet endpoint in our Kops deployment (Kops is managing Kubernetes v1.12.9) I see the following cert details</p>

<pre><code>subject=CN = ip-10-1-2-3.ec2.internal@1561089780
issuer=CN = ip-10-1-2-3.ec2.internal-ca@1561089780
</code></pre>

<p>Note the issuer appears specific to that node. How does the api-server actually speak to the kubelets? Surely auth would fail due to the unknown (to api-server) CA. But it is obviously working because the cluster is functional but I don't understand why. </p>

<p>In contrast, for learning purposes, I set up a cluster <a href="https://github.com/kelseyhightower/kubernetes-the-hard-way" rel="nofollow noreferrer">manually</a> and there the Kubelet cert subject and issuers are:</p>

<pre><code>subject=CN=system:node:worker-1
issuer=CN=Kubernetes
</code></pre>

<p>(Some location boilerplate omitted)</p>

<p>Which, as I'd expect, has a common CA signing all Kubelet certs - the api-server then uses that CA with <code>--client-ca-file</code> to enable auth to the Kubelets.</p>

Friedrich 'Fred' Clausen
<p>The reason for this, in my case, was because the Kubelets are being authorized via a <a href="https://kubernetes.io/docs/reference/access-authn-authz/webhook/" rel="nofollow noreferrer">webhook</a> so the certs don't come into play.</p>
