public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-14 04:57:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix typo and add restarting pods info

Browse Source
This commit is contained in:
galal-hussein
2019-03-22 10:23:26 -07:00
committed by Denise Schannon
parent 7f9e44164d
commit 381041cafa
2 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rancher/v2.x/en/cluster-provisioning/rke-clusters/certificate-rotation/_index.md
+1 -1
View File
@@ -8,7 +8,7 @@ _Available as of v2.2.0_
By default, Kubernetes clusters require certificates and Rancher launched Kubernetes clusters have certificates automatically generated for them.
> **Note:** Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher Launched Kubernetes clusters.
hen generating certificates, the cluster certificates are set to expire after 1 year and the CA certificate expires after 10 years. Rotating these certificates are important before the certificates expire as well as if a certificate is compromised.
When generating certificates, the cluster certificates are set to expire after 1 year and the CA certificate expires after 10 years. Rotating these certificates are important before the certificates expire as well as if a certificate is compromised.
After the certificates are rotated, the Kubernetes components are automatically restarted. Certificates can be rotated for the following services:
content/rke/v0.1.x/en/cert-mgmt/_index.md
+6
View File
@@ -101,3 +101,9 @@ INFO[0001] [certificates] Generating etcd-zzzzz certificate and key
INFO[0001] Successfully Deployed state file at [./cluster.rkestate]
INFO[0001] Rebuilding Kubernetes cluster with rotated certificates
```
Rotating the CA certificate will also result in restarting some system pods to use the new CA certificate, this includes:
- Networking pods (canal, calico, flannel, and weave).
- Ingress Controller pods.
- KubeDNS pods.