Handle Kubernetes 1.36 pod certificate requests#8
Merged
Benjamin Elder (BenTheElder) merged 2 commits intoMay 20, 2026
Merged
Conversation
Benjamin Elder (BenTheElder)
requested review from
Benjamin Elder (BenTheElder) and
Taahir Ahmed (ahmedtd)
Taahir Ahmed (ahmedtd)
previously approved these changes
May 20, 2026
Benjamin Elder (BenTheElder)
previously approved these changes
May 20, 2026
Benjamin Elder (BenTheElder)
left a comment
Benjamin Elder (BenTheElder)
left a comment
Collaborator
There was a problem hiding this comment.
Thanks John! You can tell we've been testing with 1.35 in kind and GKE so far 😅
Kubernetes 1.36 stopped putting the subject key in spec.pkixPublicKey for PodCertificateRequest and now sends a stub PKCS#10 request instead. The old controller parsed the deprecated field unconditionally, so new PCRs had pkixPublicKey=null and failed with an ASN.1 'sequence truncated' error before any certificate could be issued. Add a shared helper that extracts the public key from spec.stubPKCS10Request first and falls back to spec.pkixPublicKey for older clusters. Both pod identity and service DNS signers use that path, so their behavior stays consistent across Kubernetes versions. Bump the Kubernetes dependencies to expose the new field and update controller-runtime to the matching generation. Add focused tests for CSR extraction, PKIX fallback, and missing key material.
John Howard (howardjohn)
force-pushed
the
cert/fix-sign
branch
from
df40689 to
7ef4e8f
Compare
John Howard (howardjohn)
force-pushed
the
cert/fix-sign
branch
from
7ef4e8f to
9113e88
Compare
Benjamin Elder (BenTheElder)
merged commit e1ff0ad
into
agent-substrate:main
4 checks passed
Tim Hockin (thockin)
pushed a commit
that referenced
this pull request
May 20, 2026
Discussed this morning with other maintainers. We know we need to test more with 1.36 (see #8), this is just the declaration of intent to start.
Benjamin Elder (BenTheElder)
added
the
kind/bug
2 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Kubernetes 1.36 stopped putting the subject key in spec.pkixPublicKey for PodCertificateRequest and now sends a stub PKCS#10 request instead. The old controller parsed the deprecated field unconditionally, so new PCRs had pkixPublicKey=null and failed with an ASN.1 'sequence truncated' error before any certificate could be issued.
Add a shared helper that extracts the public key from spec.stubPKCS10Request first and falls back to spec.pkixPublicKey for older clusters. Both pod identity and service DNS signers use that path, so their behavior stays consistent across Kubernetes versions. Bump the Kubernetes dependencies to expose the new field and update controller-runtime to the matching generation.
Without this, the
ate-systempod all fail to start due to missing certificates.