feat(spokes): verified kubelet serving certificates and metrics-server #127

Merged

karsten merged 6 commits from feat/metrics-server-verified-kubelet-tls into main 2026-10-10 11:09:37 +00:00

Conversation 0 Commits 6 Files changed 58 +2493 -20

karsten commented 2026-10-10 11:09:29 +00:00

Owner

Copy link

Verified kubelet serving certificates and metrics-server for CAPI Spokes (decision "metrics-server option a").

• Kubelets: serverTLSBootstrap: true via kubeadm patches (/etc/kubernetes/patches) on control plane, workers and gateway.
• New foundation kubelet-csr-approver (postfinance 1.2.15, digest-pinned): approves only CSRs with CN = node, DNS SAN matching the Spoke machine prefix, IP SAN in the Spoke node network. Upstream helm test hook (unpinned busybox) removed.
• New foundation metrics-server (0.9.0, digest-pinned): verifies kubelets against the cluster CA (no --kubelet-insecure-tls); APIService served via cert-manager certificate, insecureSkipTLSVerify: false.
• Admission: APIService boundary (only v1beta1.metrics.k8s.io -> kube-system/metrics-server), CRB exceptions for metrics-server; admission chart 0.2.0.
• Management policy: both addons with exact values; approver IP prefix bound to the shared bootstrap network or a masked /24 of spoke_networks.pool (verified live via server dry-run).
• Renderer refuses spec changes of immutable templates (KCP/OpenStackMachine/OpenStackCluster templates) without a revision bump.
• make check now fails on ansible/tofu/helm errors (errexit); stale rendering tests restored.

No re-render, nothing changes live. Rollout: bump management_revision + bootstrap 61, then re-render gs-joget/gs-xroad with control_plane_template_revision: r3.

Review: GPT-6-Sol, 3 rounds; round 3 only one P2 (false positive: renderer enforces /24 in pool).

Verified kubelet serving certificates and metrics-server for CAPI Spokes (decision "metrics-server option a"). - Kubelets: `serverTLSBootstrap: true` via kubeadm patches (`/etc/kubernetes/patches`) on control plane, workers and gateway. - New foundation `kubelet-csr-approver` (postfinance 1.2.15, digest-pinned): approves only CSRs with CN = node, DNS SAN matching the Spoke machine prefix, IP SAN in the Spoke node network. Upstream helm test hook (unpinned busybox) removed. - New foundation `metrics-server` (0.9.0, digest-pinned): verifies kubelets against the cluster CA (no `--kubelet-insecure-tls`); APIService served via cert-manager certificate, `insecureSkipTLSVerify: false`. - Admission: APIService boundary (only `v1beta1.metrics.k8s.io` -> `kube-system/metrics-server`), CRB exceptions for metrics-server; admission chart 0.2.0. - Management policy: both addons with exact values; approver IP prefix bound to the shared bootstrap network or a masked /24 of `spoke_networks.pool` (verified live via server dry-run). - Renderer refuses spec changes of immutable templates (KCP/OpenStackMachine/OpenStackCluster templates) without a revision bump. - `make check` now fails on ansible/tofu/helm errors (errexit); stale rendering tests restored. No re-render, nothing changes live. Rollout: bump management_revision + bootstrap 61, then re-render gs-joget/gs-xroad with `control_plane_template_revision: r3`. Review: GPT-6-Sol, 3 rounds; round 3 only one P2 (false positive: renderer enforces /24 in pool).

karsten added 6 commits 2026-10-10 11:09:29 +00:00

chore(vendor): import metrics-server chart 3.14.0 and kubelet-csr-approver chart 1.2.15 ... 1f2196cf20

Unmodified upstream chart archives:
- metrics-server-3.14.0.tgz sha256 c2ca1185c01e6e7f53dd1b7d131f0c9b3fa50e003ed068b784563a1b5a3422a1
- kubelet-csr-approver-1.2.15.tgz sha256 a8697589fadc4aedb68f01a66f2cf50a780d9648ad3f463d041722902091e32f

feat(spokes): verified kubelet serving certificates and metrics-server ... 489950757e

Kubelets on CAPI Spokes request serving certificates from the cluster CA
(serverTLSBootstrap via kubeadm patches). kubelet-csr-approver approves only
node-identity- and node-network-bound CSRs; metrics-server verifies kubelets
against the cluster CA and serves its aggregated API with a cert-manager
certificate. Admission restricts foundation APIServices and the metrics-server
system bindings; the Management policy admits both addons with exact values.
The renderer refuses spec changes of immutable templates without a revision
bump.

docs(spokes): record why KubeadmConfigTemplate is outside the immutable-template guard 36b3c1dcf0

fix(policy): bind kubelet-csr-approver IP prefixes to Spoke node networks 1b27fc6671

fix(policy): render approver network alternatives only when configured 10d462a18f

fix(checks): fail make check on ansible, tofu and helm validation errors ... ff54a6ff97

The tool-guarded blocks ran without errexit, so failing rendering
playbooks were swallowed. Restore the stale rendering tests (observability
contract, Tier-2 Argo destination, current Application set, metrics CA
moved out of Argo) and select bootstrap files by path.

karsten merged commit ad25fa011d into main 2026-10-10 11:09:37 +00:00

karsten deleted branch feat/metrics-server-verified-kubelet-tls 2026-10-10 11:09:38 +00:00

karsten referenced this pull request from a commit 2026-10-10 11:09:39 +00:00

Merge pull request 'feat(spokes): verified kubelet serving certificates and metrics-server' (#127) from feat/metrics-server-verified-kubelet-tls into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

govstack/govstack-bootstrap!127

No description provided.