public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 04:28:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

cert fixes

Browse Source
This commit is contained in:
Denise Schannon
2019-03-22 10:23:26 -07:00
parent 3e579cd92a
commit 9653d2049a
2 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rancher/v2.x/en/cluster-provisioning/rke-clusters/certificate-rotation/_index.md
+8 -3
View File
@@ -5,12 +5,11 @@ weight: 2245
_Available as of v2.2.0_
By default, Kubernetes clusters require certificates and Rancher launched Kubernetes clusters have certificates automatically generated for them.
By default, Kubernetes clusters require certificates and Rancher launched Kubernetes clusters automatically generate certificates for the Kubernetes components. Rotating these certificates is important before the certificates expire as well as if a certificate is compromised. After the certificates are rotated, the Kubernetes components are automatically restarted.
> **Note:** Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher Launched Kubernetes clusters.
When generating certificates, the cluster certificates are set to expire after 1 year and the CA certificate expires after 10 years. Rotating these certificates is important before the certificates expire as well as if a certificate is compromised.
After the certificates are rotated, the Kubernetes components are automatically restarted. Certificates can be rotated for the following services:
Certificates can be rotated for the following services:
- etcd
- kubelet
@@ -31,6 +30,12 @@ Rancher launched Kubernetes clusters have the ability to rotate the auto-generat
* Rotate all Service certificates (keep the same CA)
* Rotate an individual service and choose one of the services from the drop down menu
> **Note:** Rotating the CA certificate will result in restarting other system pods, that will also use the new CA certificate. This includes:
>
>- Networking pods (canal, calico, flannel, and weave)
>- Ingress Controller pods
>- KubeDNS pods
4. Click **Save**.
**Results:** The selected certificates will be rotated and the related services will be restarted to start using the new certificate.
content/rke/v0.1.x/en/cert-mgmt/_index.md
+1 -3
View File
@@ -18,7 +18,7 @@ You can use the CSRs and keys to sign the certificates by a real CA. After the c
## Certificate Rotation
By default, Kubernetes clusters require certificates and RKE will automatically generate certificates for the clusters. When generating certificates, the certificates in each service are set to expire after 1 year and the CA certificate expires after 10 years. Rotating these certificates are important before the certificates expire as well as if a certificate is compromised.
By default, Kubernetes clusters require certificates and RKE will automatically generate certificates for the clusters. Rotating these certificates are important before the certificates expire as well as if a certificate is compromised.
After the certificates are rotated, the Kubernetes components are automatically restarted. Certificates can be rotated for the following services:
@@ -107,5 +107,3 @@ INFO[0001] [certificates] Generating etcd-zzzzz certificate and key
INFO[0001] Successfully Deployed state file at [./cluster.rkestate]
INFO[0001] Rebuilding Kubernetes cluster with rotated certificates
```