public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 04:28:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

rm RKE1 references: rotate-certificates

Browse Source
This commit is contained in:
Billy Tat
2025-07-30 16:57:16 -07:00
parent 3bbb4cee45
commit 4e1ae95bc2
4 changed files with 4 additions and 116 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/how-to-guides/new-user-guides/manage-clusters/rotate-certificates.md
+1 -29
View File
@@ -16,20 +16,6 @@ By default, Kubernetes clusters require certificates and Rancher launched Kubern
Certificates can be rotated for the following services:
<Tabs>
<TabItem value="RKE">
- etcd
- kubelet (node certificate)
- kubelet (serving certificate, if [enabled](https://rancher.com/docs/rke/latest/en/config-options/services/#kubelet-options))
- kube-apiserver
- kube-proxy
- kube-scheduler
- kube-controller-manager
</TabItem>
<TabItem value="RKE2">
- admin
- api-server
- controller-manager
@@ -42,9 +28,6 @@ Certificates can be rotated for the following services:
- kubelet
- kube-proxy
</TabItem>
</Tabs>
:::note
For users who didn't rotate their webhook certificates, and they have expired after one year, please see this [page](../../../troubleshooting/other-troubleshooting-tips/expired-webhook-certificate-rotation.md) for help.
@@ -68,15 +51,4 @@ Rancher launched Kubernetes clusters have the ability to rotate the auto-generat
### Additional Notes
<Tabs>
<TabItem value="RKE">
Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher launched Kubernetes clusters.
</TabItem>
<TabItem value="RKE2">
In RKE2, both etcd and control plane nodes are treated as the same `server` concept. As such, when rotating certificates of services specific to either of these components will result in certificates being rotated on both. The certificates will only change for the specified service, but you will see nodes for both components go into an updating state. You may also see worker only nodes go into an updating state. This is to restart the workers after a certificate change to ensure they get the latest client certs.
</TabItem>
</Tabs>
In RKE2/K3s, both etcd and control plane nodes are treated as the same `server` concept. As such, when rotating certificates of services specific to either of these components will result in certificates being rotated on both. The certificates will only change for the specified service, but you will see nodes for both components go into an updating state. You may also see worker only nodes go into an updating state. This is to restart the workers after a certificate change to ensure they get the latest client certs.
i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/manage-clusters/rotate-certificates.md
+1 -29
View File
@@ -12,20 +12,6 @@ title: 证书轮换
可以为以下服务轮换证书：
<Tabs>
<TabItem value="RKE">
- etcd
- kubelet（节点证书）
- kubelet（服务证书，如果[启用](https://rancher.com/docs/rke/latest/en/config-options/services/#kubelet-options)）
- kube-apiserver
- kube-proxy
- kube-scheduler
- kube-controller-manager
</TabItem>
<TabItem value="RKE2">
- admin
- api-server
- controller-manager
@@ -38,9 +24,6 @@ title: 证书轮换
- kubelet
- kube-proxy
</TabItem>
</Tabs>
:::note
如果你未轮换 webhook 证书，且证书用了一年后已经过期，请参阅此[页面](../../../troubleshooting/other-troubleshooting-tips/expired-webhook-certificate-rotation.md)。
@@ -64,15 +47,4 @@ Rancher 启动的 Kubernetes 集群能够通过 UI 轮换自动生成的证书
## 补充说明
<Tabs>
<TabItem value="RKE">
虽然 RKE CLI 可以为 Kubernetes 集群组件使用自定义证书，但 Rancher 目前不允许在 Rancher 启动的 Kubernetes 集群中上传这些证书。
</TabItem>
<TabItem value="RKE2">
在 RKE2 中，etcd 和 controlplane 节点都被视为相同的 `server`。因此，如果你轮换其中一个组件的服务证书，则两者的证书都会被轮换。证书只会针对指定的服务更改，但你会看到两个组件的节点都进入更新状态。你可能还会看到仅 Worker 节点进入更新状态。这是在证书更改后重启 Worker，以确保他们获得最新的客户端证书。
</TabItem>
</Tabs>
在 RKE2/K3s 中，etcd 和 controlplane 节点都被视为相同的 `server`。因此，如果你轮换其中一个组件的服务证书，则两者的证书都会被轮换。证书只会针对指定的服务更改，但你会看到两个组件的节点都进入更新状态。你可能还会看到仅 Worker 节点进入更新状态。这是在证书更改后重启 Worker，以确保他们获得最新的客户端证书。
i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/manage-clusters/rotate-certificates.md
+1 -29
View File
@@ -12,20 +12,6 @@ title: 证书轮换
可以为以下服务轮换证书：
<Tabs>
<TabItem value="RKE">
- etcd
- kubelet（节点证书）
- kubelet（服务证书，如果[启用](https://rancher.com/docs/rke/latest/en/config-options/services/#kubelet-options)）
- kube-apiserver
- kube-proxy
- kube-scheduler
- kube-controller-manager
</TabItem>
<TabItem value="RKE2">
- admin
- api-server
- controller-manager
@@ -38,9 +24,6 @@ title: 证书轮换
- kubelet
- kube-proxy
</TabItem>
</Tabs>
:::note
如果你未轮换 webhook 证书，且证书用了一年后已经过期，请参阅此[页面](../../../troubleshooting/other-troubleshooting-tips/expired-webhook-certificate-rotation.md)。
@@ -64,15 +47,4 @@ Rancher 启动的 Kubernetes 集群能够通过 UI 轮换自动生成的证书
## 补充说明
<Tabs>
<TabItem value="RKE">
虽然 RKE CLI 可以为 Kubernetes 集群组件使用自定义证书，但 Rancher 目前不允许在 Rancher 启动的 Kubernetes 集群中上传这些证书。
</TabItem>
<TabItem value="RKE2">
在 RKE2 中，etcd 和 controlplane 节点都被视为相同的 `server`。因此，如果你轮换其中一个组件的服务证书，则两者的证书都会被轮换。证书只会针对指定的服务更改，但你会看到两个组件的节点都进入更新状态。你可能还会看到仅 Worker 节点进入更新状态。这是在证书更改后重启 Worker，以确保他们获得最新的客户端证书。
</TabItem>
</Tabs>
在 RKE2/K3s 中，etcd 和 controlplane 节点都被视为相同的 `server`。因此，如果你轮换其中一个组件的服务证书，则两者的证书都会被轮换。证书只会针对指定的服务更改，但你会看到两个组件的节点都进入更新状态。你可能还会看到仅 Worker 节点进入更新状态。这是在证书更改后重启 Worker，以确保他们获得最新的客户端证书。
versioned_docs/version-2.12/how-to-guides/new-user-guides/manage-clusters/rotate-certificates.md
+1 -29
View File
@@ -16,20 +16,6 @@ By default, Kubernetes clusters require certificates and Rancher launched Kubern
Certificates can be rotated for the following services:
<Tabs>
<TabItem value="RKE">
- etcd
- kubelet (node certificate)
- kubelet (serving certificate, if [enabled](https://rancher.com/docs/rke/latest/en/config-options/services/#kubelet-options))
- kube-apiserver
- kube-proxy
- kube-scheduler
- kube-controller-manager
</TabItem>
<TabItem value="RKE2">
- admin
- api-server
- controller-manager
@@ -42,9 +28,6 @@ Certificates can be rotated for the following services:
- kubelet
- kube-proxy
</TabItem>
</Tabs>
:::note
For users who didn't rotate their webhook certificates, and they have expired after one year, please see this [page](../../../troubleshooting/other-troubleshooting-tips/expired-webhook-certificate-rotation.md) for help.
@@ -68,15 +51,4 @@ Rancher launched Kubernetes clusters have the ability to rotate the auto-generat
### Additional Notes
<Tabs>
<TabItem value="RKE">
Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher launched Kubernetes clusters.
</TabItem>
<TabItem value="RKE2">
In RKE2, both etcd and control plane nodes are treated as the same `server` concept. As such, when rotating certificates of services specific to either of these components will result in certificates being rotated on both. The certificates will only change for the specified service, but you will see nodes for both components go into an updating state. You may also see worker only nodes go into an updating state. This is to restart the workers after a certificate change to ensure they get the latest client certs.
</TabItem>
</Tabs>
In RKE2/K3s, both etcd and control plane nodes are treated as the same `server` concept. As such, when rotating certificates of services specific to either of these components will result in certificates being rotated on both. The certificates will only change for the specified service, but you will see nodes for both components go into an updating state. You may also see worker only nodes go into an updating state. This is to restart the workers after a certificate change to ensure they get the latest client certs.