From 18782580f5fa57b7c8821c4ff0da1fa8c3ada435 Mon Sep 17 00:00:00 2001 From: younsl Date: Thu, 12 Nov 2026 23:42:06 +0900 Subject: [PATCH] charts: document that Kubernetes 1.37+ needs no certificate feature gates The chart docs said Pod Certificates need beta feature gates and the certificates.k8s.io/v1beta1 API. Substrate uses certificates.k8s.io/v1 first, so Kubernetes 1.37 and later need neither. Managed control planes such as EKS cannot turn on beta APIs, so the old wording made them look unsupported. Fixes #168 Signed-off-by: younsl --- charts/substrate-podcert/README.md | 6 ++++-- charts/substrate/README.md | 7 +++++-- charts/substrate/templates/NOTES.txt | 10 +++++----- charts/substrate/values.yaml | 6 ++++-- 4 files changed, 18 insertions(+), 11 deletions(-) diff --git a/charts/substrate-podcert/README.md b/charts/substrate-podcert/README.md index 368142e2f5..faa5e1a7d4 100644 --- a/charts/substrate-podcert/README.md +++ b/charts/substrate-podcert/README.md @@ -5,8 +5,10 @@ of the application release. It issues service DNS and pod identity certificates and publishes their cluster trust bundles. It does not require PostgreSQL or a certificate issued by itself. -The cluster must enable `ClusterTrustBundle`, `ClusterTrustBundleProjection`, -and `PodCertificateRequest`, including the `certificates.k8s.io/v1beta1` API. +The cluster must serve Pod Certificates and Cluster Trust Bundles. Kubernetes +1.37 and later serve them at `certificates.k8s.io/v1` by default. On earlier +versions, enable `ClusterTrustBundle`, `ClusterTrustBundleProjection`, and +`PodCertificateRequest`, including the `certificates.k8s.io/v1beta1` API. Create `service-dns-ca-pool`, `pod-identity-ca-pool`, and `postgres-ca-pool` Secrets in the controller's namespace before installation. Each Secret must contain a signing pool in its `pool` key. The existing setup command creates diff --git a/charts/substrate/README.md b/charts/substrate/README.md index 35d7bc96c8..6827ed0b6f 100644 --- a/charts/substrate/README.md +++ b/charts/substrate/README.md @@ -2,9 +2,12 @@ Helm chart for installing Agent Substrate. -The chart uses mTLS and requires a prepared PostgreSQL database. It requires the +The chart uses mTLS and requires a prepared PostgreSQL database. It also +requires Pod Certificates and Cluster Trust Bundles. Kubernetes 1.37 and later +serve them at `certificates.k8s.io/v1` by default, with no feature gates or +`--runtime-config` changes. On earlier versions, enable the `ClusterTrustBundle`, `ClusterTrustBundleProjection`, and -`PodCertificateRequest` feature gates plus the `certificates.k8s.io/v1beta1` +`PodCertificateRequest` feature gates and the `certificates.k8s.io/v1beta1` API. Install the [certificate controller](../substrate-podcert/README.md) as a separate diff --git a/charts/substrate/templates/NOTES.txt b/charts/substrate/templates/NOTES.txt index c0e9875a45..08b0cd6be6 100644 --- a/charts/substrate/templates/NOTES.txt +++ b/charts/substrate/templates/NOTES.txt @@ -1,7 +1,7 @@ substrate {{ .Chart.AppVersion }} installed with mTLS and PostgreSQL -REQUIRED Kubernetes feature gates: - - ClusterTrustBundle - - ClusterTrustBundleProjection - - PodCertificateRequest -The certificates.k8s.io/v1beta1 API must also be enabled. +REQUIRED: Pod Certificates and Cluster Trust Bundles. + - Kubernetes 1.37 and later: served at certificates.k8s.io/v1 by default. + - Earlier versions: enable the ClusterTrustBundle, + ClusterTrustBundleProjection, and PodCertificateRequest feature gates + and the certificates.k8s.io/v1beta1 API. diff --git a/charts/substrate/values.yaml b/charts/substrate/values.yaml index 5d0f7a4dce..dd31ac8ae5 100644 --- a/charts/substrate/values.yaml +++ b/charts/substrate/values.yaml @@ -14,8 +14,10 @@ # Default values for the substrate chart. # -# The chart requires ClusterTrustBundle, ClusterTrustBundleProjection, -# PodCertificateRequest, and the certificates.k8s.io/v1beta1 API. +# The chart requires Pod Certificates and Cluster Trust Bundles, served at +# certificates.k8s.io/v1 by default on Kubernetes 1.37 and later. Earlier +# versions need the ClusterTrustBundle, ClusterTrustBundleProjection, and +# PodCertificateRequest feature gates and the certificates.k8s.io/v1beta1 API. # Set to true to have the chart create the release namespace. # Off by default — most helm workflows expect the namespace to already exist