From bc2ed912d9c2dfc37f9e0054acd60a827aa6957c Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Thu, 21 May 2020 11:52:56 -0400 Subject: [PATCH] Rotate kubelet client certificates GA --- content/en/docs/tasks/tls/certificate-rotation.md | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/content/en/docs/tasks/tls/certificate-rotation.md b/content/en/docs/tasks/tls/certificate-rotation.md index 890621c19f..ea3602fbb0 100644 --- a/content/en/docs/tasks/tls/certificate-rotation.md +++ b/content/en/docs/tasks/tls/certificate-rotation.md @@ -10,7 +10,7 @@ content_type: task This page shows how to enable and configure certificate rotation for the kubelet. -{{< feature-state for_k8s_version="v1.8" state="beta" >}} +{{< feature-state for_k8s_version="v1.19" state="stable" >}} ## {{% heading "prerequisites" %}} @@ -38,14 +38,12 @@ the Kubernetes API. The `kubelet` process accepts an argument `--rotate-certificates` that controls if the kubelet will automatically request a new certificate as the expiration of -the certificate currently in use approaches. Since certificate rotation is a -beta feature, the feature flag must also be enabled with -`--feature-gates=RotateKubeletClientCertificate=true`. +the certificate currently in use approaches. The `kube-controller-manager` process accepts an argument -`--experimental-cluster-signing-duration` that controls how long certificates -will be issued for. +`--cluster-signing-duration` (`--experimental-cluster-signing-duration` prior to 1.19) +that controls how long certificates will be issued for. ## Understanding the certificate rotation configuration @@ -62,8 +60,8 @@ Initially a certificate signing request from the kubelet on a node will have a status of `Pending`. If the certificate signing requests meets specific criteria, it will be auto approved by the controller manager, then it will have a status of `Approved`. Next, the controller manager will sign a certificate, -issued for the duration specified by the -`--experimental-cluster-signing-duration` parameter, and the signed certificate +issued for the duration specified by the +`--cluster-signing-duration` parameter, and the signed certificate will be attached to the certificate signing requests. The kubelet will retrieve the signed certificate from the Kubernetes API and