epostnikof/kubespray
1
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-03-26 03:28:28 +03:00
Code Issues Packages Projects Releases Wiki Activity

Test: when hardening test needs enabled csr approve

Browse Source 
Signed-off-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com>
This commit is contained in:
ChengHao Yang
2026-01-11 01:37:43 +08:00
parent 275cdc70d4
commit 0458d33698
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
tests/files/ubuntu24-calico-all-in-one-hardening.yml
View File

@@ -75,7 +75,10 @@ etcd_deployment_type: kubeadm
kubelet_authentication_token_webhook: true kubelet_authentication_token_webhook: true
kube_read_only_port: 0 kube_read_only_port: 0
kubelet_rotate_server_certificates: true kubelet_rotate_server_certificates: true
kubelet_csr_approver_enabled: false kubelet_csr_approver_enabled: true # For hydrophone
kubelet_csr_approver_values:
# Do not check DNS resolution in testing (not recommended in production)
bypassDnsResolution: true
kubelet_protect_kernel_defaults: true kubelet_protect_kernel_defaults: true
kubelet_event_record_qps: 1 kubelet_event_record_qps: 1
kubelet_rotate_certificates: true kubelet_rotate_certificates: true