kubeadm: generate a client certificate with "system:masters" in a separate file

[neolit123]

Enhancement Description

• One-line enhancement description (can be used as a release note): Don't bind the admin.conf user to system:masters in kubeadm. Create a separate conf file with the super user group and generate it on kubeadm init.
• Kubernetes Enhancement Proposal: https://git.k8s.io/enhancements/keps/sig-cluster-lifecycle/kubeadm/4214-separate-super-user-kubeconfig
• Discussion Link: Feature Reqest: Don't bind the admin.conf user to system:masters kubeadm#2414
• Primary contact (assignee): @neolit123
• Responsible SIGs: Cluster Lifecycle
• Enhancement target (which target equals to which milestone):
  • Alpha release target (x.y): -
  • Beta release target (x.y): -
  • Stable release target (x.y): 1.29 (graduates directly)

Please keep this description up to date. This will help the Enhancement Team to track the evolution of the enhancement efficiently.

kubernetes/kubeadm#2414

KEP file changes:

• kubeadm: add KEP 4214 for separate super-user kubeconfig #4218
• keps/../kubeadm: 4214: revisit test plan and risks/mitigations #4302

[npolshakova]

Hello @neolit123, 1.29 Enhancements team here! Is this enhancement targeting 1.29? If it is, can you follow the instructions here to opt in the enhancements and make sure the lead-opted-in label is set so it can get added to the tracking board? Thanks!

[neolit123]

Hello @neolit123, 1.29 Enhancements team here! Is this enhancement targeting 1.29? If it is, can you follow the instructions here to opt in the enhancements and make sure the lead-opted-in label is set so it can get added to the tracking board? Thanks!

hi, is it possible to not opt-in into the enhancement tracking? asking as a sig lead.

[npolshakova]

Yep, currently this enhancement is not being tracked in the 1.29 enhancements tracking project board. If that's the intention, you don't need to change anything. You've set the milestone as 1.29 so I wanted to double check you didn't intend it to be tracked for 1.29.

[neolit123]

If that's the intention, you don't need to change anything.

yes, preferably. we do all the docs / e2e / code tracking changes ourself as kubeadm is a relatively small project.

[salehsedghpour]

Hello 👋 1.30 Enhancements Lead here,

I'm closing milestone 1.29 now,
If you wish to progress this enhancement in v1.30, please follow the instructions here to opt in the enhancement and make sure the lead-opted-in label is set so it can get added to the tracking board and finally add /milestone v1.30. Thanks!

/milestone clear

[pacoxu]

@SataQiu @neolit123 Is there other task for this feature after kubernetes/kubernetes#122786 is merged?

[neolit123]

no, that's the last PR we plan to merge.

[k8s-triage-robot]

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

• After 90d of inactivity, lifecycle/stale is applied
• After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
• After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

• Mark this issue as fresh with /remove-lifecycle stale
• Close this issue with /close
• Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

[neolit123]

this is done