From 85cc70b33368247336f34c6cb49c6613385ccadd Mon Sep 17 00:00:00 2001 From: aliakbar Date: Tue, 13 Jul 2021 22:56:09 +0430 Subject: [PATCH] Add explanations for control-plane pods restart after certificate renewal --- .../administer-cluster/kubeadm/kubeadm-certs.md | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md index be98558659..63b95d0eb5 100644 --- a/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md +++ b/content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md @@ -126,7 +126,18 @@ command. In that case, you should explicitly set `--certificate-renewal=true`. You can renew your certificates manually at any time with the `kubeadm certs renew` command. -This command performs the renewal using CA (or front-proxy-CA) certificate and key stored in `/etc/kubernetes/pki`. +This command performs the renewal using CA (or front-proxy-CA) certificate and key stored in `/etc/kubernetes/pki`. + +After running the command you should restart the control plane Pods. This is required since +dynamic certificate reload is currently not supported for all components and certificates. +[Static Pods](/docs/tasks/configure-pod-containerstatic-pod/) are managed by the local kubelet +and not by the API Server, thus kubectl cannot be used to delete and restart them. +To restart a static Pod you can temporarily remove its manifest file from `/etc/kubernetes/manifests/` +and wait for 20 seconds (see the `fileCheckFrequency` value in [KubeletConfiguration struct](/docs/ +reference/config-api/kubelet-config.v1beta1/). +The kubelet will terminate the Pod if it's no longer in the manifest directory. +You can then move the file back and after another `fileCheckFrequency` period, the kubelet will recreate +the Pod and the certificate renewal for the component can complete. {{< warning >}} If you are running an HA cluster, this command needs to be executed on all the control-plane nodes.