Merge pull request #21108 from liggitt/csr-ga

Rotate kubelet client certificates GA, CSR API GA

content/en/docs/tasks/tls/certificate-rotation.md

@@ -10,7 +10,7 @@ content_type: task
 This page shows how to enable and configure certificate rotation for the kubelet.
 
 
-{{< feature-state for_k8s_version="v1.8" state="beta" >}}
+{{< feature-state for_k8s_version="v1.19" state="stable" >}}
 
 ## {{% heading "prerequisites" %}}
 
@@ -38,14 +38,12 @@ the Kubernetes API.
 
 The `kubelet` process accepts an argument `--rotate-certificates` that controls
 if the kubelet will automatically request a new certificate as the expiration of
-the certificate currently in use approaches.  Since certificate rotation is a
-beta feature, the feature flag must also be enabled with
-`--feature-gates=RotateKubeletClientCertificate=true`.
+the certificate currently in use approaches.
 
 
 The `kube-controller-manager` process accepts an argument
-`--experimental-cluster-signing-duration` that controls how long certificates
-will be issued for.
+`--cluster-signing-duration`  (`--experimental-cluster-signing-duration` prior to 1.19)
+that controls how long certificates will be issued for.
 
 ## Understanding the certificate rotation configuration
 
@@ -62,8 +60,8 @@ Initially a certificate signing request from the kubelet on a node will have a
 status of `Pending`. If the certificate signing requests meets specific
 criteria, it will be auto approved by the controller manager, then it will have
 a status of `Approved`. Next, the controller manager will sign a certificate,
-issued for the duration specified by the
-`--experimental-cluster-signing-duration` parameter, and the signed certificate
+issued for the duration specified by the 
+`--cluster-signing-duration` parameter, and the signed certificate
 will be attached to the certificate signing requests.
 
 The kubelet will retrieve the signed certificate from the Kubernetes API and

content/en/docs/tasks/tls/managing-tls-in-a-cluster.md

@@ -109,12 +109,13 @@ command:
 
 ```shell
 cat <<EOF | kubectl apply -f -
-apiVersion: certificates.k8s.io/v1beta1
+apiVersion: certificates.k8s.io/v1
 kind: CertificateSigningRequest
 metadata:
   name: my-svc.my-namespace
 spec:
   request: $(cat server.csr | base64 | tr -d '\n')
+  signerName: kubernetes.io/kubelet-serving
   usages:
   - digital signature
   - key encipherment
@@ -125,10 +126,10 @@ EOF
 Notice that the `server.csr` file created in step 1 is base64 encoded
 and stashed in the `.spec.request` field. We are also requesting a
 certificate with the "digital signature", "key encipherment", and "server
-auth" key usages. We support all key usages and extended key usages listed
-[here](https://godoc.org/k8s.io/api/certificates/v1beta1#KeyUsage)
-so you can request client certificates and other certificates using this
-same API.
+auth" key usages, signed by the `kubernetes.io/kubelet-serving` signer.
+A specific `signerName` must be requested.
+View documentation for [supported signer names](/docs/reference/access-authn-authz/certificate-signing-requests/#signers)
+for more information.
 
 The CSR should now be visible from the API in a Pending state. You can see
 it by running: