add field to make service-ca.crt more secure
@@ -25,6 +25,14 @@ type KubeControllerManager struct {
type KubeControllerManagerSpec struct {
StaticPodOperatorSpec `json:",inline"`
+
+ // useMoreSecureServiceCA indicates that the service-ca.crt provided in SA token volumes should include only
+ // enough certificates to validate service serving certificates.
+ // Once set to true, it cannot be set to false.
+ // Even if someone finds a way to set it back to false, the service-ca.crt files that previously existed will
+ // only have the more secure content.
+ // +kubebuilder:default=false
+ UseMoreSecureServiceCA bool `json:"useMoreSecureServiceCA"`
}
type KubeControllerManagerStatus struct {
