Taahir Ahmed 3a77181b21 Pod Certificates: Node-restriction support for signer names ... Kubelet's ability to generate service account tokens is restricted by the noderestriction admission plugin, which checks to make sure that the relevant pod actually mounts a token volume with the requested audience. This commit adds an analogous mechanism for Pod Certificates, restricting the signer names that Kubelet can request. The feature includes a similar authorizer-based override, where granting the "request-podcertificate-signer" verb for a given signer name allows bypassing the restriction. Prepared with Claude Code.		2026-06-30 15:04:53 -07:00
..
OWNERS	test/integration: add missing sig labels	2026-04-10 14:01:51 +02:00
podcertificate_integration_test.go	Pod Certificates: Node-restriction support for signer names	2026-06-30 15:04:53 -07:00