public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 20:48:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Sync content from rancher/docs

Browse Source 
Start: cb708da8d Jul 7 2022
End: 09d646cfc Sep 2 2022
This commit is contained in:
Billy Tat
2022-09-09 14:21:51 -07:00
parent 38da4eb019
commit 80b78c98d5
62 changed files with 1868 additions and 467 deletions
Download Patch File Download Diff File Expand all files Collapse all files
versioned_docs/version-2.5/troubleshooting/other-troubleshooting-tips/expired-webhook-certificate-rotation.md
+25
View File
@@ -0,0 +1,25 @@
---
title: Rotation of Expired Webhook Certificates
weight: 120
---
For Rancher versions that have `rancher-webhook` installed, certain versions created certificates that will expire after one year. It will be necessary for you to rotate your webhook certificate if the certificate did not renew.
In Rancher v2.5.12 and up, rancher-webhook deployments will automatically renew their TLS certificate when it is within 30 or fewer days of its expiration date. If you are using v2.5.11 or below, there are two methods to work around this issue:
##### 1. Users with cluster access, run the following commands:
```
kubectl delete secret -n cattle-system cattle-webhook-tls
kubectl delete mutatingwebhookconfigurations.admissionregistration.k8s.io --ignore-not-found=true rancher.cattle.io
kubectl delete pod -n cattle-system -l app=rancher-webhook
```
##### 2. Users with no cluster access via `kubectl`:
1. Delete the `cattle-webhook-tls` secret in the `cattle-system` namespace in the local cluster.
2. Delete the `rancher.cattle.io` mutating webhook
3. Delete the `rancher-webhook` pod in the `cattle-system` namespace in the local cluster.
**Note:** The webhook certificate expiration issue is not specific to `cattle-webhook-tls` as listed in the examples. You will fill in your expired certificate secret accordingly.