[julestree]

How to categorize this PR?

/area security
/kind enhancement

What this PR does / why we need it:
This PR introduces a check for the CA certificates used by kubectl to make sure they are legitamate shoot CAs. It also makes sure that CAs are verified correctly during the rotation process.

The new code requires kubectl to provide the cluster information. By doing so we remove the support for kubectl versions older than 1.20 which don't provide this info.
This PR also adds a build flag insecureAllowArgumentOnly which allows the CA check to be bypassed. This can be useful for debugging and running things locally.

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Release note:

TODO

[gardener-prow]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[gardener-prow]

@julestree: The label(s) area/todo, kind/todo cannot be applied, because the repository doesn't have them.

Details

In response to this:

How to categorize this PR?

/area TODO
/kind TODO

What this PR does / why we need it:

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Release note:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[gardener-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign chrisstiefel for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn