whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #30146 from neolit123/1.23-update-ts-guide-for-cert-rotation

Browse Source 
kubeadm/TS guide: fix a misleading step about cert rotation
This commit is contained in:
Kubernetes Prow Robot
2021-11-03 18:28:03 -07:00
committed by GitHub
parent 5862d9155e 6ea5318972
commit 0c04e2c54c
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/setup/production-environment/tools/kubeadm/troubleshooting-kubeadm.md
+10 -2
View File
@@ -224,9 +224,17 @@ the `ca.key` you must sign the embedded certificates in the `kubelet.conf` exter
1. Copy this resulted `kubelet.conf` to `/etc/kubernetes/kubelet.conf` on the failed node. 1. Copy this resulted `kubelet.conf` to `/etc/kubernetes/kubelet.conf` on the failed node.
1. Restart the kubelet (`systemctl restart kubelet`) on the failed node and wait for 1. Restart the kubelet (`systemctl restart kubelet`) on the failed node and wait for
`/var/lib/kubelet/pki/kubelet-client-current.pem` to be recreated. `/var/lib/kubelet/pki/kubelet-client-current.pem` to be recreated.
1. Run `kubeadm init phase kubelet-finalize all` on the failed node. This will make the new 1. Manually edit the `kubelet.conf` to point to the rotated kubelet client certificates, by replacing
`kubelet.conf` file use `/var/lib/kubelet/pki/kubelet-client-current.pem` and will restart the kubelet. `client-certificate-data` and `client-key-data` with:
```yaml
client-certificate: /var/lib/kubelet/pki/kubelet-client-current.pem
client-key: /var/lib/kubelet/pki/kubelet-client-current.pem
```
1. Restart the kubelet.
1. Make sure the node becomes `Ready`. 1. Make sure the node becomes `Ready`.
## Default NIC When using flannel as the pod network in Vagrant ## Default NIC When using flannel as the pod network in Vagrant
The following error might indicate that something was wrong in the pod network: The following error might indicate that something was wrong in the pod network: