6a75e7c40c
This commit is the main API piece of KEP-3257 (ClusterTrustBundles). This commit: * Adds the certificates.k8s.io/v1alpha1 API group * Adds the ClusterTrustBundle type. * Registers the new type in kube-apiserver. * Implements the type-specfic validation specified for ClusterTrustBundles: - spec.pemTrustAnchors must always be non-empty. - spec.signerName must be either empty or a valid signer name. - Changing spec.signerName is disallowed. * Implements the "attest" admission check to restrict actions on ClusterTrustBundles that include a signer name. Because it wasn't specified in the KEP, I chose to make attempts to update the signer name be validation errors, rather than silently ignored. I have tested this out by launching these changes in kind and manipulating ClusterTrustBundle objects in the resulting cluster using kubectl.
Kubernetes hack GuideLines
This document describes how you can use the scripts from hack directory
and gives a brief introduction and explanation of these scripts.
Overview
The hack directory contains many scripts that ensure continuous development of kubernetes,
enhance the robustness of the code, improve development efficiency, etc.
The explanations and descriptions of these scripts are helpful for contributors.
For details, refer to the following guidelines.
Key scripts
verify-all.sh: This script is a vestigial redirection, Please do not add "real" logic. It is equivalent tomake verify.update-all.sh: This script is a vestigial redirection, Please do not add "real" logic. Thetruetarget of this makerule ishack/make-rules/update.sh.It is equivalent tomake update.
Attention
Note that all scripts must be run from the Kubernetes root directory.
We should run hack/verify-all.sh before submitting a PR and if anything fails run hack/update-all.sh.