Refactor Certificates Documentation #51487

ahmedtd · 2025-07-02T22:06:33Z

This change breaks apart the "Certificates" reference documentation (which currently lives under the API Access, Authentication, and Authorization section of the reference documentation. It becomes:

reference/access-authn-authz/certificate-signing-requests.md (The current doc) --- narrowly focused on using client certificates to authenticate to the Kubernetes API.
concepts/security/certificates.md: (most of the content from the current doc) A deep-dive on signers, CertificateSigningRequests, PodCertificateRequests, ClusterTrustBundles, and the built-in signers.
tasks/extend-kubernetes/custom-signer.md: A guide to creating your own custom signer.

netlify · 2025-07-02T22:06:38Z

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

Name	Link
🔨 Latest commit	`3400449`
🔍 Latest deploy log	https://app.netlify.com/projects/kubernetes-io-vnext-staging/deploys/689420bd5c2e770008d93c55

netlify · 2025-07-02T22:17:01Z

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`8ba16fc`
🔍 Latest deploy log	https://app.netlify.com/projects/kubernetes-io-main-staging/deploys/6894337d4c3d40000900723f
😎 Deploy Preview	https://deploy-preview-51487--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

lmktfy · 2025-07-03T07:43:13Z

/retitle [WIP] Document Pod certificate requests

ahmedtd · 2025-07-23T05:06:59Z

/assign stlaz

michellengnx · 2025-07-23T16:20:44Z

Hello @ahmedtd 👋 please take a look at Documenting for a release - PR Ready for Review to get your PR ready for review before Tuesday July 29th 2025 18:00 PST. Thank you!

k8s-ci-robot · 2025-08-07T05:03:00Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign nate-double-u for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

content/en/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

windsonsea · 2025-08-08T01:32:57Z

/remove-language es hi id ja pt ru uk zh
/remove-area localization web-development

lmktfy · 2025-08-09T09:10:15Z

/label refactor

lmktfy · 2025-08-09T09:14:32Z

content/en/docs/concepts/security/certificates.md

+  override_link_text: "CSR v1"
+- apiVersion: "certificates.k8s.io/v1beta1"
+  kind: "ClusterTrustBundle"
+- apiVersion: "certificates.k8s.io/v1alpha1"


For a PR targeting main we can't accept this yet.
Docs are continuously deployed and main should document the latest (released) minor release, ie v1.33 at time of writing.

/hold
We can't merge this yet but we can do everything bar that.

lmktfy · 2025-08-09T09:16:53Z

content/en/docs/concepts/security/certificates.md

+  client certificate.
+
+<!-- body -->
+


Here, let's do a stub that mentions two common certificate tasks, and signposts people to go there:

set up TLS for your workload, with a valid cert

rotate the certs your existing cluster uses - see issue Document requirements/recommended process for updating cluster TLS certs/keys #30575

A stub is all it needs.

lmktfy · 2025-08-09T09:18:46Z

content/en/docs/concepts/security/certificates.md

+this 15-minute limit.
+
+
+## ClusterTrustBundles {#cluster-trust-bundles}


I would introduce these before the other API kinds in this document. They are in away useful without any of the other concepts: you can use them to distribute trust anchors to your workloads. That's a common need.

lmktfy · 2025-08-09T09:19:34Z

content/en/docs/concepts/security/certificates.md

+
+All ClusterTrustBundle objects have strong validation on the contents of their
+`trustBundle` field. That field must contain one or more X.509 certificates,
+DER-serialized, each wrapped in a PEM `CERTIFICATE` block. The certificates


nit: could hyperlink to the RFC that standardized certs in PEM format.

lmktfy · 2025-08-09T09:20:28Z

content/en/docs/concepts/security/certificates.md

+kubectl get clustertrustbundles --as='system:serviceaccount:mynamespace:default'
+```
+
+### Signer-linked ClusterTrustBundles {#ctb-signer-linked}


We can have this even if we haven't fully explained what signers are. An initial outline and are hyperlink could be enough.

lmktfy · 2025-08-09T09:21:05Z

content/en/docs/concepts/security/certificates.md

+See the [clusterTrustBundle projected volume source](/docs/concepts/storage/projected-volumes#clustertrustbundle) for more details.
+
+
+## Kubernetes built-in signers {#kubernetes-signers}


I would have this list of signers in the reference section of the docs.

lmktfy · 2025-08-09T09:22:52Z

content/en/docs/reference/access-authn-authz/webhook.md

-With the `AuthorizeWithSelectors` feature enabled, field and label selectors in the request
-are passed to the authorization webhook. The webhook can make authorization decisions
+When calling out to an authorization webhook, Kubernetes passes
+label and field selectors in the request to the authorization webhook.


nit: optionally, make "selectors" a glossary_tooltip

micahhausler

I think the biggest thing missing in the projected volume docs is details on private key generation. Users who are regulated or just care about PKI will want to know what process is generating it, where its located, and any options on key size/algo/if you can use hardware generation/etc

micahhausler · 2025-08-11T16:21:35Z

content/en/docs/concepts/security/certificates.md

+---
+reviewers:
+- liggitt
+- mikedanese


Is this autogenerated based on OWNERS? I'm happy to be a reviewer here instead of Mike

I think it's been copy and pasted. There's no automatic maintenance that I know of.

micahhausler · 2025-08-11T16:22:28Z

content/en/docs/concepts/security/certificates.md

+* CertificateSigningRequest: An API type that lets you request an arbitrary
+  certificate from a signer.
+* PodCertificateRequest: (alpha) An API type that lets `kubelet` request
+  certificates to inject into a Pod.


nit:

Suggested change

certificates to inject into a Pod.

certificates to mount into a Pod.

I think inject is better, actually. Today it's only supported using a mount, but in a future minor release we might offer other ways to use the cert and private key (example: your sandbox sees it in a kernel-provided keyring).

micahhausler · 2025-08-11T16:22:50Z

content/en/docs/concepts/security/certificates.md

+
+{{< feature-state feature_gate_name="ClusterTrustBundleProjection" >}}
+
+The contents of ClusterTrustBundles can be injected into the container filesystem, similar to ConfigMaps and Secrets.


Suggested change

The contents of ClusterTrustBundles can be injected into the container filesystem, similar to ConfigMaps and Secrets.

The contents of ClusterTrustBundles can be mounted into the container filesystem, similar to ConfigMaps and Secrets.

micahhausler · 2025-08-11T16:24:01Z

content/en/docs/concepts/security/certificates.md

+* ClusterTrustBundle: (beta) A group of certificates (typically CA root
+  certificates) that should be used as roots of trust for verifying a server or
+  client certificate.


Suggested change

* ClusterTrustBundle: (beta) A group of certificates (typically CA root

certificates) that should be used as roots of trust for verifying a server or

client certificate.

* ClusterTrustBundle: (beta) A list of certificates (typically CA root

certificates) that can be used as a root of trust for verifying a server or

client certificate.

micahhausler · 2025-08-11T16:25:58Z

content/en/docs/concepts/security/certificates.md

+example, `kubernetes.io/foo`).  Each signer uniquely identifies a category of
+certificates that can be issued within the scope of a particular cluster.
+Kubernetes offers some [built-in signers](#kubernetes-signers), and third-party
+signers may also be freely installed into a cluster.


nit: 'installed' typically implies a pod running in the cluster, but a signer just needs to be an API client, and can be hosted externally

Suggested change

signers may also be freely installed into a cluster.

signers may also be used with a cluster.

micahhausler · 2025-08-11T16:27:11Z

content/en/docs/concepts/security/certificates.md

+  signer-linked ClusterTrustBundles or ConfigMaps
+
+The Kubernetes project provides a set of [built-in signers](#kubernetes-signers)
+that are available in every cluster.  It is also possible to install (or build


Suggested change

that are available in every cluster. It is also possible to install (or build

that are available in every cluster. It is also possible to use (or build

micahhausler · 2025-08-11T16:35:35Z

content/en/docs/concepts/security/certificates.md

+
+Once created, a CSR must be approved before it can be signed. Approval is
+indicated by adding an `Approved` entry to `status.conditions`.  Denial is
+indicated by adding a `Denied` entry to `status.conditions`.  Both of these


nit: My understanding is that you wouldn't have 2 contradictory conditions in the same list, I'd suggest making it "either" or just "These conditions..."

Suggested change

indicated by adding a `Denied` entry to `status.conditions`. Both of these

indicated by adding a `Denied` entry to `status.conditions`. These

micahhausler · 2025-08-11T16:51:37Z

content/en/docs/concepts/security/certificates.md

+
+To ensure that terminal PodCertificateRequests do not build up in the cluster, a
+`kube-controller-manager` controller deletes all PodCertificateRequests older
+than 15 minutes.  All certificate issuance flows are expected to complete within


We might want to specify how to configure this. I can think of very large clusters where this timeout might be an issue

IIRC this currently cannot be configured.

micahhausler · 2025-08-11T16:53:57Z

content/en/docs/concepts/security/certificates.md

+
+ClusterTrustBundle objects should be considered world-readable within the
+cluster. If your cluster uses [RBAC](/docs/reference/access-authn-authz/rbac/)
+authorization, all ServiceAccounts have a default grant that allows them to


😬 Is this a removable RBAC permission?

You can edit the clusterrolebinding and opt-out of its auto-reconcile per https://kubernetes.io/docs/reference/access-authn-authz/rbac/#auto-reconciliation.
Just curious - what's the use case? Are you trying to prevent undesired trust, perhaps?

micahhausler · 2025-08-11T17:03:23Z

content/en/docs/concepts/security/certificates.md

+
+There is no built-in auto-approval controller for this signer; all certificates
+must be manually approved, or a third-party auto-approval controller must be
+installed.


Suggested change

installed.

used.

lmktfy · 2025-08-11T21:59:14Z

content/en/docs/concepts/security/certificates.md

+* CertificateSigningRequest: An API type that lets you request an arbitrary
+  certificate from a signer.
+* PodCertificateRequest: (alpha) An API type that lets `kubelet` request
+  certificates to inject into a Pod.


I think inject is better, actually. Today it's only supported using a mount, but in a future minor release we might offer other ways to use the cert and private key (example: your sandbox sees it in a kernel-provided keyring).

lmktfy · 2025-08-11T22:00:29Z

content/en/docs/concepts/security/certificates.md

+{{< note >}}
+When encoded in JSON or YAML, `status.certificate` field is base-64 encoded, so
+it is not directly readable.  This is handled transparently when using a client
+library.


I think that depends on exactly which client library you use, and we can't confidently assume every user has picked the one we were thinking of.

stlaz · 2025-08-13T11:15:43Z

content/en/docs/concepts/security/certificates.md

+The three API types for requesting and trusting certificates are:
+* CertificateSigningRequest: An API type that lets you request an arbitrary
+  certificate from a signer.
+* PodCertificateRequest: (alpha) An API type that lets `kubelet` request


Don't hardcode feature maturity, find a way to incorporate {{< feature-state feature_gate_name="NAME_HERE" >}}. This is otherwise hard to find and replace when the feature matures further.

We can go too far with making maintenance low toil. Here's how I'd strike a balance.

keep this wording; leave in “(alpha)”

just afterwards, add an HTML comment that mentions the feature gate name (which is PodCertificateRequests, plural)

edit content/en/docs/reference/command-line-tools-reference/feature-gates/PodCertificateRequests.md with another HTML comment to search for the feature gates in the English docs and tidy up any matches, on graduation

That's enough of a hint to make maintenance easy, but also makes live comfortable for readers. For the K8s docs, we have many many more readers than writers, so we should prefer choices that impose lower costs on readers, provided the effort to do so is reasonable.

HTML comments are an easily-understood way to leave notes for contributors, that don't harm the end user experience. And they work in Markdown.

Bear in mind that my suggestion won't 100% work out, yet, because this PR is a work in progress (either it targets the wrong branch, or it shouldn't mention PodCertificateRequest yet). But you get the idea.

stlaz · 2025-08-13T11:22:36Z

content/en/docs/concepts/security/certificates.md

+Kubernetes certificate and trust bundle APIs enable automation of
+[X.509](https://www.itu.int/rec/T-REC-X.509) credential provisioning by
+providing a programmatic interface for clients of the Kubernetes API to request
+and obtain X.509 {{< glossary_tooltip term_id="certificate" text="certificates"
+>}} from a Certificate Authority (CA).


This paragraph is a little odd. In short it reads as "Kubernetes cert/trust bundle APIs enable credential provisioning by providing APIs for clients of these APIs". Try to rephrase somehow, please.

stlaz · 2025-08-13T11:46:54Z

content/en/docs/concepts/security/certificates.md

+The CSR flow begins when a requester creates a CSR object:
+* `spec.signerName` says which signer should process the CSR.
+* `spec.request` contains a PEM-wrapped PKCS#10 signing request.
+* `spec.expirationSeconds` (optional) allows the requester to ask for a specific
+  lifetime for the issued certificate.
+* `spec.usages` contains the key usages that the requester wants on the issued
+  certificate. 


Should we leave specific fields docs here to the API reference and only mention what the CSR object is capable of? Alternatively mention that this list is not exhaustive and ref the docs from above for further details.

stlaz · 2025-08-13T11:58:04Z

content/en/docs/concepts/security/certificates.md

+be approved.  Broadly speaking:
+* Some signers automatically approve conforming CSRs, and will refuse to issue a
+  certificate to a non-conforming CSR.  These signers will move an approved, but
+  non-conforming CSR into the `Failed` terminal state, rather than issuing it.


This should probably mention the "Failed" condition, otherwise the terminal state is not properly defined.

stlaz · 2025-08-13T12:00:55Z

content/en/docs/concepts/security/certificates.md

+{{< /note >}}
+
+Signer implementations are encouraged to:
+* Document whether or not they consider manual approval decisions on


This?

Suggested change

* Document whether or not they consider manual approval decisions on

* Document whether or not they require manual approval decisions on

They would always consider manual approvals, right? Maybe unless they approve and issue in a single step?

stlaz · 2025-08-14T11:57:20Z

content/en/docs/concepts/storage/projected-volumes.md

+The `podCertificate` projected volumes source securely provisions a private key
+and X.509 certificate chain for pod to use as client or server credentials.
+Kubelet will then handle refreshing the private key and certificate chain when
+they get close to expiration.  The application just has to make sure that it


nit

Suggested change

they get close to expiration. The application just has to make sure that it

they get close to expiration. The application needs to be able to react to these file changes

stlaz · 2025-08-14T12:06:24Z

content/en/docs/tasks/extend-kubernetes/custom-signer.md

+You can also introduce your own custom signer, which should have a similar
+prefixed name but using your own domain name. For example, if you represent an


If this is its own page, the "similar prefixed name" gets confusing as you don't know what it should be similar to.

Suggested change

You can also introduce your own custom signer, which should have a similar

prefixed name but using your own domain name. For example, if you represent an

Kubernetes lets you introduce your own custom signer that should have a similar (?)

prefixed name but using your own domain name. For example, if you represent an

stlaz · 2025-08-14T12:08:14Z

content/en/docs/tasks/extend-kubernetes/custom-signer.md

+
+#### CertificateSigningRequests {#useful-cluster-roles-csr}
+
+CertificateSigningRequests have three roles &mdash; requesters, approvers, and


Suggested change

CertificateSigningRequests have three roles — requesters, approvers, and

There are three roles to consider with CertificateSigningRequests — requesters, approvers, and

stlaz · 2025-08-14T12:12:36Z

content/en/docs/tasks/extend-kubernetes/custom-signer.md

+Allowing broad read access to CSRs is not a security issue, because the CSRs
+only contain public (not private) keys.


It's not on us to decide what is and isn't a security issue. Some might even consider being able to see who requests which certs as a security issue. Think leaking service hostnames in a multi-tenant cluster, for example.

stlaz · 2025-08-14T12:18:37Z

content/en/docs/tasks/extend-kubernetes/custom-signer.md

+{{< mermaid >}} 
+stateDiagram-v2
+
+direction LR
+
+Initial --> Wait
+Wait --> Fresh
+Wait --> Failed
+Wait --> Denied
+Fresh --> WaitRefresh
+WaitRefresh --> Failed
+WaitRefresh --> Denied
+
+{{< /mermaid >}}


do we want to highlight start/final states? Does that work in our docs?

k8s-ci-robot · 2025-08-18T11:54:18Z

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

stlaz · 2025-08-20T08:16:43Z

content/en/docs/concepts/security/certificates.md

+
+{{< feature-state feature_gate_name="ClusterTrustBundle" >}}
+
+This signer does not issue any certificates.  It purely serves to distribute the


It still issues certificates but that is all done externally, not automated by the vanilla platform.

stlaz · 2025-08-20T08:21:02Z

content/en/docs/concepts/security/certificates.md

+
+This signer does not issue any certificates.  It purely serves to distribute the
+trust anchors that allow workloads within the cluster to verify the API server's
+server certificate when they connect to `kubernetes.default.svc`.


kubernetes.defaults.svc is only one of the ways to connect to the kube-apiserver. See https://github.com/kubernetes/website/pull/48492/files#diff-6d12239777c4a9144a2fb9051645d7ace1f7d2a4a79f28e819c1dafb4bde0abeR219-R220

stlaz · 2025-08-20T08:25:12Z

content/en/docs/concepts/security/certificates.md

+trust anchors that allow workloads within the cluster to verify the API server's
+server certificate when they connect to `kubernetes.default.svc`.
+
+There are three built-in distribution mechanisms for these trust anchors:


You should mention all the other expectations that we have on the certs signed by this signer. While they are all not necessarily enforced, they could still be considered best practice, which is worth documenting. See what I had in #48492, I believe most of the doc there was agreed on when I was updating the KEP.

The "Certificates" page is creaking under its own weight, and is due to be split up. This is being pursued in a separate PR: kubernetes#51487

k8s-ci-robot added this to the 1.34 milestone Jul 2, 2025

k8s-ci-robot added the cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. label Jul 2, 2025

k8s-ci-robot requested a review from enj July 2, 2025 22:06

k8s-ci-robot added the language/en Issues or PRs related to English language label Jul 2, 2025

k8s-ci-robot requested a review from mikedanese July 2, 2025 22:06

k8s-ci-robot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Jul 2, 2025

ahmedtd mentioned this pull request Jul 2, 2025

Pod Certificates kubernetes/enhancements#4317

Open

11 tasks

k8s-ci-robot changed the title ~~Pod Certificate Requests: Placeholder update~~ [WIP] Document Pod certificate requests Jul 3, 2025

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 3, 2025

ahmedtd force-pushed the podcertificates branch from b8aedd6 to 61de463 Compare July 22, 2025 23:39

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Jul 22, 2025

ahmedtd force-pushed the podcertificates branch from 61de463 to 8019dae Compare July 22, 2025 23:56

k8s-ci-robot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jul 23, 2025

ahmedtd force-pushed the podcertificates branch 2 times, most recently from 79b343d to 6ce8b70 Compare July 23, 2025 05:01

ahmedtd changed the title ~~[WIP] Document Pod certificate requests~~ [WIP] Document PodCertificateRequests, PodCertificate Projections, and Reorganize Certificate/Signer Documentation Jul 23, 2025

k8s-ci-robot assigned stlaz Jul 23, 2025

ahmedtd force-pushed the podcertificates branch 2 times, most recently from f35bb0a to 8363ffd Compare July 23, 2025 07:38

ahmedtd force-pushed the podcertificates branch 3 times, most recently from 4268852 to 9a8f68c Compare July 24, 2025 20:02

ahmedtd changed the title ~~[WIP] Document PodCertificateRequests, PodCertificate Projections, and Reorganize Certificate/Signer Documentation~~ Document PodCertificateRequests, PodCertificate Projections, and Reorganize Certificate/Signer Documentation Jul 24, 2025

ahmedtd force-pushed the podcertificates branch from 3400449 to 8ba16fc Compare August 7, 2025 05:02

enj added this to SIG Auth Aug 7, 2025

enj moved this to Needs Triage in SIG Auth Aug 7, 2025

k8s-ci-robot added the refactor Indicates a PR with large refactoring changes e.g. removes files or moves content label Aug 9, 2025

lmktfy reviewed Aug 9, 2025

View reviewed changes

k8s-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 9, 2025

micahhausler suggested changes Aug 11, 2025

View reviewed changes

github-project-automation bot moved this from Needs Triage to Changes Requested in SIG Auth Aug 11, 2025

lmktfy reviewed Aug 11, 2025

View reviewed changes

stlaz reviewed Aug 14, 2025

View reviewed changes

lmktfy mentioned this pull request Aug 14, 2025

Fix metadata for PodCertificateRequest feature gate #51915

Merged

This comment was marked as off-topic.

Sign in to view

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Aug 18, 2025

stlaz suggested changes Aug 20, 2025

View reviewed changes

stlaz mentioned this pull request Aug 20, 2025

Document kubernetes.io/kube-apiserver-serving ClusterTrustBundle signer #48492

Closed

kamothi pushed a commit to kamothi/website that referenced this pull request Oct 2, 2025

Pod Certificates: Narrow documentation of new feature

ef3feba

The "Certificates" page is creaking under its own weight, and is due to be split up. This is being pursued in a separate PR: kubernetes#51487

		this 15-minute limit.


		## ClusterTrustBundles {#cluster-trust-bundles}

		See the [clusterTrustBundle projected volume source](/docs/concepts/storage/projected-volumes#clustertrustbundle) for more details.


		## Kubernetes built-in signers {#kubernetes-signers}

	certificates to inject into a Pod.
	certificates to mount into a Pod.


		{{< feature-state feature_gate_name="ClusterTrustBundleProjection" >}}

		The contents of ClusterTrustBundles can be injected into the container filesystem, similar to ConfigMaps and Secrets.

	signers may also be freely installed into a cluster.
	signers may also be used with a cluster.

	that are available in every cluster. It is also possible to install (or build
	that are available in every cluster. It is also possible to use (or build

	indicated by adding a `Denied` entry to `status.conditions`. Both of these
	indicated by adding a `Denied` entry to `status.conditions`. These

	* Document whether or not they consider manual approval decisions on
	* Document whether or not they require manual approval decisions on

	they get close to expiration. The application just has to make sure that it
	they get close to expiration. The application needs to be able to react to these file changes

		You can also introduce your own custom signer, which should have a similar
		prefixed name but using your own domain name. For example, if you represent an


		#### CertificateSigningRequests {#useful-cluster-roles-csr}

		CertificateSigningRequests have three roles — requesters, approvers, and

	CertificateSigningRequests have three roles — requesters, approvers, and
	There are three roles to consider with CertificateSigningRequests — requesters, approvers, and

		Allowing broad read access to CSRs is not a security issue, because the CSRs
		only contain public (not private) keys.


		{{< feature-state feature_gate_name="ClusterTrustBundle" >}}

		This signer does not issue any certificates. It purely serves to distribute the

Uh oh!

Refactor Certificates Documentation #51487

Are you sure you want to change the base?

Refactor Certificates Documentation #51487

Conversation

ahmedtd commented Jul 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify bot commented Jul 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

👷 Deploy Preview for kubernetes-io-vnext-staging processing.

Uh oh!

netlify bot commented Jul 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Pull request preview available for checking

Uh oh!

lmktfy commented Jul 3, 2025

Uh oh!

ahmedtd commented Jul 23, 2025

Uh oh!

michellengnx commented Jul 23, 2025

Uh oh!

k8s-ci-robot commented Aug 7, 2025

Uh oh!

windsonsea commented Aug 8, 2025

Uh oh!

lmktfy commented Aug 9, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lmktfy Aug 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

micahhausler left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

ahmedtd commented Jul 2, 2025 •

edited

Loading

netlify bot commented Jul 2, 2025 •

edited

Loading

netlify bot commented Jul 2, 2025 •

edited

Loading

lmktfy Aug 9, 2025 •

edited

Loading

lmktfy Aug 14, 2025 •

edited

Loading