From a1f4adc249472a61c2b7549e7e5d45780a24e8e3 Mon Sep 17 00:00:00 2001 From: divya-mohan0209 Date: Wed, 23 Mar 2022 10:29:23 +0530 Subject: [PATCH] Amendments made per review --- .../certificate-rotation/_index.md | 52 +------------------ .../certificate-rotation/_index.md | 52 +------------------ 2 files changed, 2 insertions(+), 102 deletions(-) diff --git a/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md b/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md index 44fe2820c2b..8eba2be2765 100644 --- a/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md +++ b/content/rancher/v2.5/en/cluster-admin/certificate-rotation/_index.md @@ -20,9 +20,7 @@ Certificates can be rotated for the following services: - kube-controller-manager -### Certificate Rotation in Rancher v2.2.x - -_Available as of v2.2.0_ +### Certificate Rotation Rancher launched Kubernetes clusters have the ability to rotate the auto-generated certificates through the UI. @@ -40,51 +38,3 @@ Rancher launched Kubernetes clusters have the ability to rotate the auto-generat **Results:** The selected certificates will be rotated and the related services will be restarted to start using the new certificate. > **Note:** Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher Launched Kubernetes clusters. - - -### Certificate Rotation in Rancher v2.1.x and v2.0.x - -_Available as of v2.0.14 and v2.1.9_ - -Rancher launched Kubernetes clusters have the ability to rotate the auto-generated certificates through the API. - -1. In the **Global** view, navigate to the cluster that you want to rotate certificates. - -2. Select the **⋮ > View in API**. - -3. Click on **RotateCertificates**. - -4. Click on **Show Request**. - -5. Click on **Send Request**. - -**Results:** All Kubernetes certificates will be rotated. - -### Rotating Expired Certificates After Upgrading Older Rancher Versions - -If you are upgrading from Rancher v2.0.13 or earlier, or v2.1.8 or earlier, and your clusters have expired certificates, some manual steps are required to complete the certificate rotation. - -1. For the `controlplane` and `etcd` nodes, log in to each corresponding host and check if the certificate `kube-apiserver-requestheader-ca.pem` is in the following directory: - - ``` - cd /etc/kubernetes/.tmp - ``` - - If the certificate is not in the directory, perform the following commands: - - ``` - cp kube-ca.pem kube-apiserver-requestheader-ca.pem - cp kube-ca-key.pem kube-apiserver-requestheader-ca-key.pem - cp kube-apiserver.pem kube-apiserver-proxy-client.pem - cp kube-apiserver-key.pem kube-apiserver-proxy-client-key.pem - ``` - - If the `.tmp` directory does not exist, you can copy the entire SSL certificate to `.tmp`: - - ``` - cp -r /etc/kubernetes/ssl /etc/kubernetes/.tmp - ``` - -1. Rotate the certificates. For Rancher v2.0.x and v2.1.x, use the [Rancher API.](#certificate-rotation-in-rancher-v2-1-x-and-v2-0-x) For Rancher 2.2.x, [use the UI.](#certificate-rotation-in-rancher-v2-2-x) - -1. After the command is finished, check if the `worker` nodes are Active. If not, log in to each `worker` node and restart the kubelet and proxy. diff --git a/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md b/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md index aa500d52c52..4e0e0488271 100644 --- a/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md @@ -20,9 +20,7 @@ Certificates can be rotated for the following services: > **Note:** For users who didn't rotate their webhook certificates, and they have expired after one year, please see this [page]({{}}/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/) for help. -### Certificate Rotation in Rancher v2.2.x - -_Available as of v2.2.0_ +### Certificate Rotation Rancher launched Kubernetes clusters have the ability to rotate the auto-generated certificates through the UI. @@ -40,51 +38,3 @@ Rancher launched Kubernetes clusters have the ability to rotate the auto-generat **Results:** The selected certificates will be rotated and the related services will be restarted to start using the new certificate. > **Note:** Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher Launched Kubernetes clusters. - - -### Certificate Rotation in Rancher v2.1.x and v2.0.x - -_Available as of v2.0.14 and v2.1.9_ - -Rancher launched Kubernetes clusters have the ability to rotate the auto-generated certificates through the API. - -1. In the **Global** view, navigate to the cluster that you want to rotate certificates. - -2. Select the **⋮ > View in API**. - -3. Click on **RotateCertificates**. - -4. Click on **Show Request**. - -5. Click on **Send Request**. - -**Results:** All Kubernetes certificates will be rotated. - -### Rotating Expired Certificates After Upgrading Older Rancher Versions - -If you are upgrading from Rancher v2.0.13 or earlier, or v2.1.8 or earlier, and your clusters have expired certificates, some manual steps are required to complete the certificate rotation. - -1. For the `controlplane` and `etcd` nodes, log in to each corresponding host and check if the certificate `kube-apiserver-requestheader-ca.pem` is in the following directory: - - ``` - cd /etc/kubernetes/.tmp - ``` - - If the certificate is not in the directory, perform the following commands: - - ``` - cp kube-ca.pem kube-apiserver-requestheader-ca.pem - cp kube-ca-key.pem kube-apiserver-requestheader-ca-key.pem - cp kube-apiserver.pem kube-apiserver-proxy-client.pem - cp kube-apiserver-key.pem kube-apiserver-proxy-client-key.pem - ``` - - If the `.tmp` directory does not exist, you can copy the entire SSL certificate to `.tmp`: - - ``` - cp -r /etc/kubernetes/ssl /etc/kubernetes/.tmp - ``` - -1. Rotate the certificates. For Rancher v2.0.x and v2.1.x, use the [Rancher API.](#certificate-rotation-in-rancher-v2-1-x-and-v2-0-x) For Rancher 2.2.x, [use the UI.](#certificate-rotation-in-rancher-v2-2-x) - -1. After the command is finished, check if the `worker` nodes are Active. If not, log in to each `worker` node and restart the kubelet and proxy.