From 295ee9b6b4f99077dafe027775e4db7b3043cee5 Mon Sep 17 00:00:00 2001 From: Jerome Petazzoni Date: Sun, 15 Nov 2020 19:29:45 +0100 Subject: [PATCH] Add warning about using CSR API for user certs --- slides/k8s/csr-api.md | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/slides/k8s/csr-api.md b/slides/k8s/csr-api.md index fabf5c5f..934c2eb6 100644 --- a/slides/k8s/csr-api.md +++ b/slides/k8s/csr-api.md @@ -108,6 +108,26 @@ The CA (or anyone else) never needs to know my private key. --- +## Warning + +- The CSR API isn't really suited to issue user certificates + +- It is primarily intended to issue control plane certificates + + (for instance, deal with kubelet certificates renewal) + +- The API was expanded a bit in Kubernetes 1.19 to encompass broader usage + +- There are still lots of gaps in the spec + + (e.g. how to specify expiration in a standard way) + +- ... And no other implementation to this date + + (but [cert-manager](https://cert-manager.io/docs/faq/#kubernetes-has-a-builtin-certificatesigningrequest-api-why-not-use-that) might eventually get there!) + +--- + ## General idea - We will create a Namespace named "users"