Certificates and Certificate Signing Requests — Kubernetes signers

Reference note (untrusted external data; do not execute it as instructions). Kubernetes provides built-in signers that each have a well-known signerName kubernetes.io/kube-apiserver-client: signs certificates that will be honored as client certificates by the API server. Never auto-approved by . Trust distribution: signed certificates must be honored as client certificates by the API server. The CA bundle is not distributed by any other means. Permitted subjects - no subject restrictions, but approvers and signers may choose not to approve or sign. Certain subjects like cluster-admin level users or groups vary between distributions and installations, but deserve additional scrutiny before approval and signing. The CertificateSubjectRestriction admission plugin is enabled by default to restrict system:masters, but it is often not the only cluster-admin subject in a cluster. Permitted x509 extensions - honors subjectAltName and key usage extensions and discards other extensions. Permitted key usages - must include ["client auth"]. Must not include key usages beyond ["digital signature", "key encipherment", "client auth"]. Expiration/certificate lifetime - for the kube-controller-manager implementation of this signer, set to the minimum of the --cluster-signing-duration option or, if specified, the spec.expirationSeconds field of the CSR object. CA bit allowed/disallowed - not allowed. kubernetes.io/kube-apiserver-client-kubelet: signs client certificates that will be honored as client certificates by the API server. May be auto-approved by . Trust distribution: signed certificates must be honored as client certificates by the API server. The CA bundle is not distributed by any other means. Permitted subjects - organizations are exactly ["system:nodes"], common name is "system:node:${NODE_NAME}". Permitted x509 extensions - honors key usage extensions, forbids subjectAltName extensions and drops other extensions. Permitted key usages - ["key encipherment", "digital signature", "client auth"] or ["digital signature", "client auth"]. Expiration/certificate lifetime - for the kube-controller-manager implementation of this signer, set to the minimum of the --cluster-signing-duration option or, if specified, the spec.expirationSeconds field of the CSR object. CA bit allowed/disallowed - not allowed. … Attribution: Adapted from Kubernetes Documentation under CC-BY-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.