From 61e330d06dfd44274beb102f7eee2681032c3f0e Mon Sep 17 00:00:00 2001 From: "Lubomir I. Ivanov" Date: Thu, 8 Oct 2020 04:09:35 +0300 Subject: [PATCH] manual-ca-rotation: adjust note for "--client-ca-file" - Instead of telling the users to remove the flag, tell them that they can point to a copy of the new CA for --client-ca-file --cluster-signing-cert-file that is not in a bundle with the old CA. - Don't reference the kubeadm issue. If sig-auth has a tracking issue for --client-ca-file / --cmanual-ca-rotation: adjust note for "--client-ca-file" - Instead of telling the users to remove the --client-ca-file flag, tell them that they can point to a copy of the new CA. Mention the same for --cluster-signing-cert-file. - Don't reference the kubeadm issue. If sig-auth has a tracking issue for --client-ca-file / --cluster-signing-cert-file and bundles we can add that at some point. --- .../docs/tasks/tls/manual-rotation-of-ca-certificates.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/content/en/docs/tasks/tls/manual-rotation-of-ca-certificates.md b/content/en/docs/tasks/tls/manual-rotation-of-ca-certificates.md index 9d7516aeef..d458832db0 100644 --- a/content/en/docs/tasks/tls/manual-rotation-of-ca-certificates.md +++ b/content/en/docs/tasks/tls/manual-rotation-of-ca-certificates.md @@ -38,9 +38,11 @@ Configurations with a single API server will experience unavailability while the Any service account created after this point will get secrets that include both old and new CAs. {{< note >}} - Remove the flag `--client-ca-file` from the *Kubernetes controller manager* configuration. - You can also replace the existing client CA file or change this configuration item to reference a new, updated CA. - [Issue 1350](https://github.com/kubernetes/kubeadm/issues/1350) tracks an issue with *Kubernetes controller manager* being unable to accept a CA bundle. + The files specified by the *Kubernetes controller manager* flags `--client-ca-file` and `--cluster-signing-cert-file` + cannot be CA bundles. If these flags and `--root-ca-file` point to the same `ca.crt` file which is now a + bundle (includes both old and new CA) you will face an error. To workaround this problem you can copy the new CA to a separate + file and make the flags `--client-ca-file` and `--cluster-signing-cert-file` point to the copy. Once `ca.crt` is no longer + a bundle you can restore the problem flags to point to `ca.crt` and delete the copy. {{< /note >}} 1. Update all service account tokens to include both old and new CA certificates.