public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-24 20:18:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

Explain how to rotate certs after upgrading old Rancher

Browse Source
This commit is contained in:
Catherine Luse
2019-09-09 03:40:30 -07:00
parent cbd327a952
commit 08e5a5e730
2 changed files with 32 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rancher/v2.x/en/cluster-admin/certificate-rotation/_index.md
+30 -1
View File
@@ -55,4 +55,33 @@ Rancher launched Kubernetes clusters have the ability to rotate the auto-generat
5. Click on **Send Request**.
**Results:** All kubernetes certificates will be rotated.
**Results:** All Kubernetes certificates will be rotated.
### Rotating Expired Certificates After Upgrading Older Rancher Versions
If you are upgrading from Rancher v2.0.13 or earlier, or v2.1.8 or earlier, and your clusters have expired certificates, some manual steps are required to complete the certificate rotation.
1. For the `controlplane` and `etcd` nodes, log in to each corresponding host and check if the certificate `kube-apiserver-requestheader-ca.pem` is in the following directory:
```
cd /etc/kubernetes/.tmp
```
If the certificate is not in the directory, perform the following commands:
```
cp kube-ca.pem kube-apiserver-requestheader-ca.pem
cp kube-ca-key.pem kube-apiserver-requestheader-ca-key.pem
cp kube-apiserver.pem kube-apiserver-proxy-client.pem
cp kube-apiserver-key.pem kube-apiserver-proxy-client-key.pem
```
If the `.tmp` directory does not exist, you can copy the entire SSL certificate to `.tmp`:
```
cp -r /etc/kubernetes/ssl /etc/kubernetes/.tmp
```
1. Rotate the certificates. For Rancher v2.0.x and v2.1.x, use the [Rancher API.](#certificate-rotation-in-rancher-v2-1-x-and-v2-0-x) For Rancher 2.2.x, [use the UI.](#certificate-rotation-in-rancher-v2-2-x)
1. After the command is finished, check if the `worker` nodes are Active. If not, log in to each `worker` node and restart the kubelet and proxy.
content/rancher/v2.x/en/upgrades/upgrades/_index.md
+2
View File
@@ -4,6 +4,8 @@ weight: 1005
---
This section contains information about how to upgrade your Rancher server to a newer version.
> **Note:** If you are upgrading from from Rancher v2.0.13 or earlier, or v2.1.8 or earlier, and your cluster's certificates have expired, you will need to perform [additional steps]({{<baseurl>}}/rancher/v2.x/en/cluster-admin/certificate-rotation/#rotating-expired-certificates-after-upgrading-older-rancher-versions) to rotate the certificates.
### Single Node Install
- [Upgrading a Single Node Install]({{< baseurl >}}/rancher/v2.x/en/upgrades/upgrades/single-node-upgrade/)