Kubelet CA certificate location changes on AKS 1.16+ about helm-charts

[vboulineau]

Hey @TJEvans,

It's a long standing issue with AKS, unlike most managed K8S (and the two other big players), they do not follow the usual best practices:

• The ca.crt mounted by the service account is not the one used to target Kubelet
• The Kubelet cert does not have SAN for node IP, nor the reverse-lookup of the node IP

With latest AKS, it required mounting the CA from host + using DD_KUBELET_HOST = spec.nodeName to work properly.

We've started the work to improve the Kubelet configurability with this PR: #144 (added kubelet.host), we'll work on adding something like hostCaCertPath to automatically generate the volumes/volumeMounts

[sabareeshkkanan]

when can we expect this issue to be resolved ?