KEP-6038: HTTPS (TLS) for kube-proxy admin endpoints#6041
KEP-6038: HTTPS (TLS) for kube-proxy admin endpoints#6041yashsingh74 wants to merge 1 commit intokubernetes:masterfrom
Conversation
yashsingh74
commented
Apr 29, 2026
yashsingh74
commented
- One-line PR description: HTTPS (TLS) for kube-proxy admin endpoints
- Issue link: HTTPS (TLS) for kube-proxy admin endpoints (metrics & healthz) #6038
- Other comments:
Signed-off-by: yashsingh74 <yashsingh1774@gmail.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: yashsingh74 The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
k8s-ci-robot
added
cncf-cla: yes
k8s-ci-robot
added
sig/network
|
@yashsingh74: The following test failed, say
Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
| Extend **`KubeProxyConfiguration`** (`pkg/proxy/apis/config`, all served versions, defaults, validation, conversion) with nested structures similar in spirit to other components’ secure serving options, for example: | ||
|
|
||
| ```yaml | ||
| apiVersion: kubeproxy.config.k8s.io/v1alpha1 | ||
| kind: KubeProxyConfiguration | ||
| metricsBindAddress: 0.0.0.0:10249 | ||
| healthzBindAddress: 0.0.0.0:10256 | ||
| # New fields (illustrative names — finalize in API review) | ||
| metricsServerTLS: | ||
| enable: true | ||
| certFile: /var/lib/kube-proxy/pki/metrics.crt | ||
| keyFile: /var/lib/kube-proxy/pki/metrics.key | ||
| # optional: clientCAFile for mTLS | ||
| healthzServerTLS: | ||
| enable: true | ||
| certFile: /var/lib/kube-proxy/pki/healthz.crt | ||
| keyFile: /var/lib/kube-proxy/pki/healthz.key | ||
| ``` | ||
|
|
||
| **Fields to consider** (exact names subject to API review): | ||
|
|
||
| - `enable` (bool): when false, HTTP (current behavior). | ||
| - `certFile`, `keyFile` (strings): PEM paths; required when `enable` is true. | ||
| - Optional: `clientCAFile` for client verification; `cipherSuites`, `minVersion`, `curvePreferences` aligned with existing Kubernetes flags elsewhere. | ||
| - Optional future: `certDirectory` / auto-generated self-signed certs for development only (mirrors some binaries); **not** required for MVP if it complicates security posture. |
There was a problem hiding this comment.
Can you please do the exercise of analying current kube-scheduler, kube-controller-manager and kubelet and base your proposal on that so we are consistent?
3 participants
