whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rotate kubelet client certificates GA

Browse Source
This commit is contained in:
Jordan Liggitt
2020-05-21 11:52:56 -04:00
parent 647b1d3ff0
commit bc2ed912d9
1 changed files with 6 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/tasks/tls/certificate-rotation.md
+6 -8
View File
@@ -10,7 +10,7 @@ content_type: task
This page shows how to enable and configure certificate rotation for the kubelet. This page shows how to enable and configure certificate rotation for the kubelet.
{{< feature-state for_k8s_version="v1.8" state="beta" >}} {{< feature-state for_k8s_version="v1.19" state="stable" >}}
## {{% heading "prerequisites" %}} ## {{% heading "prerequisites" %}}
@@ -38,14 +38,12 @@ the Kubernetes API.
The `kubelet` process accepts an argument `--rotate-certificates` that controls The `kubelet` process accepts an argument `--rotate-certificates` that controls
if the kubelet will automatically request a new certificate as the expiration of if the kubelet will automatically request a new certificate as the expiration of
the certificate currently in use approaches. Since certificate rotation is a the certificate currently in use approaches.
beta feature, the feature flag must also be enabled with
`--feature-gates=RotateKubeletClientCertificate=true`.
The `kube-controller-manager` process accepts an argument The `kube-controller-manager` process accepts an argument
`--experimental-cluster-signing-duration` that controls how long certificates `--cluster-signing-duration` (`--experimental-cluster-signing-duration` prior to 1.19)
will be issued for. that controls how long certificates will be issued for.
## Understanding the certificate rotation configuration ## Understanding the certificate rotation configuration
@@ -62,8 +60,8 @@ Initially a certificate signing request from the kubelet on a node will have a
status of `Pending`. If the certificate signing requests meets specific status of `Pending`. If the certificate signing requests meets specific
criteria, it will be auto approved by the controller manager, then it will have criteria, it will be auto approved by the controller manager, then it will have
a status of `Approved`. Next, the controller manager will sign a certificate, a status of `Approved`. Next, the controller manager will sign a certificate,
issued for the duration specified by the issued for the duration specified by the
`--experimental-cluster-signing-duration` parameter, and the signed certificate `--cluster-signing-duration` parameter, and the signed certificate
will be attached to the certificate signing requests. will be attached to the certificate signing requests.
The kubelet will retrieve the signed certificate from the Kubernetes API and The kubelet will retrieve the signed certificate from the Kubernetes API and