fix: add subject to certificates to satisfy cert-manager#280
Merged
k8s-ci-robot merged 1 commit intoJun 13, 2026
Merged
Conversation
This fixes an issue in which Cert-Manager would complain about a badconfig caused by the lack of a domain name, which would contravene RFC 5280 and could cause problems with some clients. The certificates now have .spec.subject.organizations set to k8s-sig-node.
k8s-ci-robot
added
kind/bug
✅ Deploy Preview for node-readiness-controller canceled.
|
k8s-ci-robot
added
size/XS
Contributor
|
/ok-to-test |
k8s-ci-robot
added
the
ok-to-test
Contributor
|
/cc |
k8s-ci-robot
added
the
lgtm
Contributor
|
/approve |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ajaysundark, vitorfloriano The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR fixes an issue in which Cert-Manager would complain about a bad config caused by the lack of a Issuer DN, which would contravene RFC 5280 and could break some strict clients. See #273.
The metris and webhook certificates now have
.spec.subject.organizationsset tok8s-sig-node, similar to the solution reached at in kubernetes-sigs/cluster-api#5387.We are changing the base certificates directly (instead of kustomizing) for simplicity and also taking into consideration that these values should always be present in the certificates, regardless.
Related Issue
Fixes #273
Type of Change
/kind bug
/kind cleanup
Testing
This fix was manually tested by:
make install.make deploy-full.kubectl events -n nrr-systemand verifying that the warnings don't show up anymore.events
kubectl describe certificaterequests.cert-manager.io -n nrr-system | grep Events -A 10and verifying the warning don't show up anymore.events
Checklist
make testpassesmake lintpassesDoes this PR introduce a user-facing change?