public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 20:48:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

rm RKE1 references: rotate-certificates

Browse Source
This commit is contained in:
Billy Tat
2025-07-30 16:57:16 -07:00
parent 3bbb4cee45
commit 4e1ae95bc2
4 changed files with 4 additions and 116 deletions
Download Patch File Download Diff File Expand all files Collapse all files
versioned_docs/version-2.12/how-to-guides/new-user-guides/manage-clusters/rotate-certificates.md
+1 -29
View File
@@ -16,20 +16,6 @@ By default, Kubernetes clusters require certificates and Rancher launched Kubern
Certificates can be rotated for the following services:
<Tabs>
<TabItem value="RKE">
- etcd
- kubelet (node certificate)
- kubelet (serving certificate, if [enabled](https://rancher.com/docs/rke/latest/en/config-options/services/#kubelet-options))
- kube-apiserver
- kube-proxy
- kube-scheduler
- kube-controller-manager
</TabItem>
<TabItem value="RKE2">
- admin
- api-server
- controller-manager
@@ -42,9 +28,6 @@ Certificates can be rotated for the following services:
- kubelet
- kube-proxy
</TabItem>
</Tabs>
:::note
For users who didn't rotate their webhook certificates, and they have expired after one year, please see this [page](../../../troubleshooting/other-troubleshooting-tips/expired-webhook-certificate-rotation.md) for help.
@@ -68,15 +51,4 @@ Rancher launched Kubernetes clusters have the ability to rotate the auto-generat
### Additional Notes
<Tabs>
<TabItem value="RKE">
Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher launched Kubernetes clusters.
</TabItem>
<TabItem value="RKE2">
In RKE2, both etcd and control plane nodes are treated as the same `server` concept. As such, when rotating certificates of services specific to either of these components will result in certificates being rotated on both. The certificates will only change for the specified service, but you will see nodes for both components go into an updating state. You may also see worker only nodes go into an updating state. This is to restart the workers after a certificate change to ensure they get the latest client certs.
</TabItem>
</Tabs>
In RKE2/K3s, both etcd and control plane nodes are treated as the same `server` concept. As such, when rotating certificates of services specific to either of these components will result in certificates being rotated on both. The certificates will only change for the specified service, but you will see nodes for both components go into an updating state. You may also see worker only nodes go into an updating state. This is to restart the workers after a certificate change to ensure they get the latest client certs.