Taahir Ahmed 3a77181b21 Pod Certificates: Node-restriction support for signer names ... Kubelet's ability to generate service account tokens is restricted by the noderestriction admission plugin, which checks to make sure that the relevant pod actually mounts a token volume with the requested audience. This commit adds an analogous mechanism for Pod Certificates, restricting the signer names that Kubelet can request. The feature includes a similar authorizer-based override, where granting the "request-podcertificate-signer" verb for a given signer name allows bypassing the restriction. Prepared with Claude Code.		2026-06-30 15:04:53 -07:00
..
admission	Pod Certificates: Node-restriction support for signer names	2026-06-30 15:04:53 -07:00
auth	Merge pull request #137204 from luxas/authorizer-decision-to-struct	2026-05-27 02:32:00 +05:30