Conversation
This prevents any principal that can create a CertificateSigningRequest from obtaining a cluster-CA-signed certificate for arbitrary names such as the Kubernetes API server. The approval logic now checks the requester identity, subject organization/CommonName, usages, and that every requested SAN belongs to the named node. Relates to GHSA-x7j5-fww5-mqmv. Also adds regression tests and a manual cluster testing guide.
…tstrap The previous guide assumed kubelet serving cert rotation was already enabled. Add a check of /var/lib/kubelet/pki and instructions to enable serverTLSBootstrap: true when kubelet-server-*.pem files are absent. Relates to GHSA-x7j5-fww5-mqmv.
Real kubelet serving CSRs generated with ECDSA keys only request digital signature and server auth, not key encipherment. Validate that server auth is present, that all usages belong to the kubelet-serving set, and reject any extra usages instead of requiring the exact three-entry set. Relates to GHSA-x7j5-fww5-mqmv.
xavpaice
marked this pull request as draft
September 8, 2026 07:20
xavpaice
marked this pull request as ready for review
September 8, 2026 07:51
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes GHSA-x7j5-fww5-mqmv.
reconcileCertificateSigningRequestspreviously approved any pendingkubernetes.io/kubelet-servingCSR without inspecting the requester, the certificate request, or the node. This allowed any principal that can create a CSR to obtain a cluster-CA-signed certificate for arbitrary names, including the Kubernetes API server.The approval logic now validates:
Spec.Usagesmatches the expected kubelet-serving set.O=system:nodesandCN=system:node:<nodeName>.Spec.Username) equals the certificate CommonName.EmailAddressesorURIs.node.Status.Addresses.Invalid CSRs are skipped with a debug log; only valid ones are approved.
Testing
pkg/ekcoops/csr_test.gocovering valid CSRs and the attack cases described in the advisory.docs/testing-kubelet-csr-rotation.md.make testpasses: lint, vet, andgo test ./pkg/... ./cmd/....make buildsucceeds.