From 2780060a789b14c86b7a59175d8aa87d8dbdea80 Mon Sep 17 00:00:00 2001 From: "Lubomir I. Ivanov" Date: Fri, 10 Nov 2023 14:16:40 +0200 Subject: [PATCH] kubeadm: change SystemPrivilegedGroup in apiserve-kubelet-client.crt The component connection between kube-apiserver and kubelet does not require the "O" field on the Subject to be set to the "system:masters" privileged group. It can be a less privileged group like "kubeadm:cluster-admins". Change the group in the apiserve-kubelet-client certificate specification. This cert is passed to --kubelet-client-certificate. --- cmd/kubeadm/app/phases/certs/certlist.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cmd/kubeadm/app/phases/certs/certlist.go b/cmd/kubeadm/app/phases/certs/certlist.go index 8c5d04665e3..babee6653bc 100644 --- a/cmd/kubeadm/app/phases/certs/certlist.go +++ b/cmd/kubeadm/app/phases/certs/certlist.go @@ -291,7 +291,7 @@ func KubeadmCertKubeletClient() *KubeadmCert { config: pkiutil.CertConfig{ Config: certutil.Config{ CommonName: kubeadmconstants.APIServerKubeletClientCertCommonName, - Organization: []string{kubeadmconstants.SystemPrivilegedGroup}, + Organization: []string{kubeadmconstants.ClusterAdminsGroupAndClusterRoleBinding}, Usages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth}, }, },