mirror of
https://github.com/agent-substrate/substrate.git
synced 2026-11-10 10:13:50 +08:00
John Howard
e1ff0ad5ff
Kubernetes 1.36 stopped putting the subject key in spec.pkixPublicKey for PodCertificateRequest and now sends a stub PKCS#10 request instead. The old controller parsed the deprecated field unconditionally, so new PCRs had pkixPublicKey=null and failed with an ASN.1 'sequence truncated' error before any certificate could be issued. Add a shared helper that extracts the public key from spec.stubPKCS10Request first and falls back to spec.pkixPublicKey for older clusters. Both pod identity and service DNS signers use that path, so their behavior stays consistent across Kubernetes versions. Bump the Kubernetes dependencies to expose the new field and update controller-runtime to the matching generation. Without this, the `ate-system` pod all fail to start due to missing certificates. - [x] Tests pass - [x] Appropriate changes to documentation are included in the PR