whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Mention time range where kubelet might renew cert

Browse Source 
The docs don't mention when the kubelet will attempt to renew a cert,
which causes concern when one notices that certain certificates are being
renewed and others are not. Adding the time frame adds certainty, so that
if an user notices a kubelet cert expiring in less than 30d, they know
something is misconfigured and should be looked at.
This commit is contained in:
sibucan
2021-02-13 10:16:43 -05:00
committed by GitHub
parent a4d3e33105
commit f58d7b5d1a
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/tasks/tls/certificate-rotation.md
+3 -2
View File
@@ -69,8 +69,9 @@ write that to disk, in the location specified by `--cert-dir`. Then the kubelet
will use the new certificate to connect to the Kubernetes API. will use the new certificate to connect to the Kubernetes API.
As the expiration of the signed certificate approaches, the kubelet will As the expiration of the signed certificate approaches, the kubelet will
automatically issue a new certificate signing request, using the Kubernetes automatically issue a new certificate signing request, using the Kubernetes API.
API. Again, the controller manager will automatically approve the certificate This can happen at any point between 30% and 10% of the time remaining on the
certificate. Again, the controller manager will automatically approve the certificate
request and attach a signed certificate to the certificate signing request. The request and attach a signed certificate to the certificate signing request. The
kubelet will retrieve the new signed certificate from the Kubernetes API and kubelet will retrieve the new signed certificate from the Kubernetes API and
write that to disk. Then it will update the connections it has to the write that to disk. Then it will update the connections it has to the