whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #26496 from sibucan/patch-1

Browse Source 
Mention the range of time in which a kubelet might renew a certificate
This commit is contained in:
Kubernetes Prow Robot
2021-02-28 13:46:39 -08:00
committed by GitHub
parent c5e52425ab f58d7b5d1a
commit 242bc24103
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/tasks/tls/certificate-rotation.md
+3 -2
View File
@@ -69,8 +69,9 @@ write that to disk, in the location specified by `--cert-dir`. Then the kubelet
will use the new certificate to connect to the Kubernetes API. will use the new certificate to connect to the Kubernetes API.
As the expiration of the signed certificate approaches, the kubelet will As the expiration of the signed certificate approaches, the kubelet will
automatically issue a new certificate signing request, using the Kubernetes automatically issue a new certificate signing request, using the Kubernetes API.
API. Again, the controller manager will automatically approve the certificate This can happen at any point between 30% and 10% of the time remaining on the
certificate. Again, the controller manager will automatically approve the certificate
request and attach a signed certificate to the certificate signing request. The request and attach a signed certificate to the certificate signing request. The
kubelet will retrieve the new signed certificate from the Kubernetes API and kubelet will retrieve the new signed certificate from the Kubernetes API and
write that to disk. Then it will update the connections it has to the write that to disk. Then it will update the connections it has to the