Authenticating users via x509 certs is important, but the project seems to be missing a mechanism to revoke certs (without throwing the entire chain away and regenerating ALL certs for all users).

It would be great to be able to declare which certs are invalid, and have the kube-apiserver, kubelets, and all other cert-dependent services deny service for requests with the now-invalid cert.

https://en.wikipedia.org/wiki/OCSP_stapling appears to be one way to solve this.

FYI - this is the same idea as the issue with CoreOS: etcd-io/etcd#4034