From 381041cafaa1632409330cdf0ff442898adfb68c Mon Sep 17 00:00:00 2001 From: galal-hussein Date: Wed, 20 Mar 2019 02:52:18 +0200 Subject: [PATCH] Fix typo and add restarting pods info --- .../rke-clusters/certificate-rotation/_index.md | 2 +- content/rke/v0.1.x/en/cert-mgmt/_index.md | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/certificate-rotation/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/certificate-rotation/_index.md index 10977946907..1a8848a5d01 100644 --- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/certificate-rotation/_index.md +++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/certificate-rotation/_index.md @@ -8,7 +8,7 @@ _Available as of v2.2.0_ By default, Kubernetes clusters require certificates and Rancher launched Kubernetes clusters have certificates automatically generated for them. > **Note:** Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher Launched Kubernetes clusters. -hen generating certificates, the cluster certificates are set to expire after 1 year and the CA certificate expires after 10 years. Rotating these certificates are important before the certificates expire as well as if a certificate is compromised. +When generating certificates, the cluster certificates are set to expire after 1 year and the CA certificate expires after 10 years. Rotating these certificates are important before the certificates expire as well as if a certificate is compromised. After the certificates are rotated, the Kubernetes components are automatically restarted. Certificates can be rotated for the following services: diff --git a/content/rke/v0.1.x/en/cert-mgmt/_index.md b/content/rke/v0.1.x/en/cert-mgmt/_index.md index 8caff87c9ad..70ec365d105 100644 --- a/content/rke/v0.1.x/en/cert-mgmt/_index.md +++ b/content/rke/v0.1.x/en/cert-mgmt/_index.md @@ -101,3 +101,9 @@ INFO[0001] [certificates] Generating etcd-zzzzz certificate and key INFO[0001] Successfully Deployed state file at [./cluster.rkestate] INFO[0001] Rebuilding Kubernetes cluster with rotated certificates ``` + +Rotating the CA certificate will also result in restarting some system pods to use the new CA certificate, this includes: + +- Networking pods (canal, calico, flannel, and weave). +- Ingress Controller pods. +- KubeDNS pods.