Inconsistency in doc for kube-apiserver-etcd-client Certificate O=system:masters requirement

[nnlkcncff]

https://kubernetes.io/docs/setup/best-practices/certificates/#all-certificates

According to the documentation, the kube-apiserver-etcd-client certificate requires O=system:masters, but how can it be needed if etcd doesn't take this into account?

Perhaps O=system:masters should be removed for the kube-apiserver-etcd-client certificate and then I can create an issue on the kubeadm repo like like the one I created earlier.

[k8s-ci-robot]

This issue is currently awaiting triage.

SIG Docs takes a lead on issue triage for this website, but any Kubernetes member can accept issues by applying the triage/accepted label.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[dipesh-rawat]

Page related to issue: https://kubernetes.io/docs/setup/best-practices/certificates/
/language en

[dipesh-rawat]

/retitle Inconsistency in doc for kube-apiserver-etcd-client Certificate O=system:masters requirement
/sig cluster-lifecycle

[sftim]

/sig api-machinery auth

[neolit123]

Perhaps O=system:masters should be removed for the kube-apiserver-etcd-client certificate and then I can create an issue on the kubeadm repo like like the one I created earlier.

+1
PRs welcome
thanks

[nnlkcncff]

@neolit123, sorry but I don't understand what do you mean — just agreement or confirmation about what should be done? :)
You seem to confirm that O=system:masters is indeed not required in the kube-apiserver-etcd-client certificate certificate, but I'm not sure because there are still no updates in the issue and the documentation is still not changed. So, I can't figure out if I should create an issue in the kubeadm repository.

[neolit123]

yes, you can log the issue in k/kubeadm.
in terms of updating the docs, i said "prs welcome", thus if you l'd like to help us you can send the docs change / pull request.