kubelet-serving-cert-approver
Automatically approves kubelet serving certificate signing requests.
kubelet-serving-cert-approver is a small controller that watches for CertificateSigningRequest objects from kubelets and auto-approves them when they meet the correct criteria. By default, Kubernetes does not auto-approve kubelet serving CSRs (only kubelet client CSRs), which prevents metrics-server and other components from scraping kubelet metrics over TLS without --kubelet-insecure-tls. This controller closes that gap.
Installation
Architecture
Deployed via a Flux Kustomization that pulls the upstream standalone-install.yaml directly from the kubelet-serving-cert-approver GitHub repo at a release tag pinned via Renovate. The namespace is labeled with pod-security.kubernetes.io/enforce: restricted. No HelmRelease; no local Helm chart.
Security
Namespace enforces the restricted Pod Security Standard (audit, warn, and enforce all set to restricted). The controller requires cluster-level RBAC to read and approve CertificateSigningRequest objects — tightly scoped to only the kubelet serving CSR sub-resource.
Updates
Managed by Renovate via the GitRepository tag reference.
Usage
No operator interaction required after installation. The controller runs continuously and automatically approves kubelet serving CSRs as nodes rotate their serving certificates. This enables metrics-server and Prometheus to scrape kubelet /metrics endpoints using valid TLS without disabling certificate verification.
Cluster-specific deviations from the above live in the per-cluster README — see k8s/platform/kubelet-serving-cert-approver/talos/README.md.