whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #24423 from neolit123/1.20-amend-ca-rotation-page

Browse Source 
manual-ca-rotation: adjust note for "--client-ca-file"
This commit is contained in:
Kubernetes Prow Robot
2020-11-23 10:45:02 -08:00
committed by GitHub
parent 793960018d c6ac783000
commit 8c61a3f2b0
1 changed files with 7 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/tasks/tls/manual-rotation-of-ca-certificates.md
+7 -4
View File
@@ -33,14 +33,17 @@ Configurations with a single API server will experience unavailability while the
(ex: `ca.crt`, `ca.key`, `front-proxy-ca.crt`, and `front-proxy-ca.key`) (ex: `ca.crt`, `ca.key`, `front-proxy-ca.crt`, and `front-proxy-ca.key`)
to all your control plane nodes in the Kubernetes certificates directory. to all your control plane nodes in the Kubernetes certificates directory.
1. Update *Kubernetes controller manager's* `--root-ca-file` to include both old and new CA and restart controller manager. 1. Update {{< glossary_tooltip text="kube-controller-manager" term_id="kube-controller-manager" >}}'s `--root-ca-file` to
include both old and new CA. Then restart the component.
Any service account created after this point will get secrets that include both old and new CAs. Any service account created after this point will get secrets that include both old and new CAs.
{{< note >}} {{< note >}}
Remove the flag `--client-ca-file` from the *Kubernetes controller manager* configuration. The files specified by the kube-controller-manager flags `--client-ca-file` and `--cluster-signing-cert-file`
You can also replace the existing client CA file or change this configuration item to reference a new, updated CA. cannot be CA bundles. If these flags and `--root-ca-file` point to the same `ca.crt` file which is now a
[Issue 1350](https://github.com/kubernetes/kubeadm/issues/1350) tracks an issue with *Kubernetes controller manager* being unable to accept a CA bundle. bundle (includes both old and new CA) you will face an error. To workaround this problem you can copy the new CA to a separate
file and make the flags `--client-ca-file` and `--cluster-signing-cert-file` point to the copy. Once `ca.crt` is no longer
a bundle you can restore the problem flags to point to `ca.crt` and delete the copy.
{{< /note >}} {{< /note >}}
1. Update all service account tokens to include both old and new CA certificates. 1. Update all service account tokens to include both old and new CA certificates.