Magnum

Atmosphere deploys Magnum with the Cluster API driver for Magnum, together with Cluster API and the Cluster API provider for OpenStack.

Kubelet serving certificate verification

Clusters created with the kubelet_serving_cert_verification_enabled=true label give every kubelet a serving certificate signed by the cluster CA, and the Kubernetes API server verifies it when it connects to a kubelet, for example for kubectl logs and exec.

Kubernetes doesn’t approve these certificates on its own, so Atmosphere installs cluster-api-csr-approver next to Cluster API. It approves a request only when every name and IP address in it belongs to the OpenStack server behind that node, and it doesn’t need any configuration.

See the driver documentation for details and troubleshooting.