public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 04:28:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1928 from btat/v2.12.0-rke1-removal-cert-encryption

Browse Source 
Remove RKE1 references: rotate certs and encryption keys
This commit is contained in:
Sunil Singh
2025-07-30 18:02:42 -07:00
committed by GitHub
parent 817895d94c 67a549b289
commit c9b36076a5
8 changed files with 20 additions and 248 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/how-to-guides/new-user-guides/manage-clusters/rotate-certificates.md
+1 -29
View File
@@ -16,20 +16,6 @@ By default, Kubernetes clusters require certificates and Rancher launched Kubern
Certificates can be rotated for the following services:
<Tabs>
<TabItem value="RKE">
- etcd
- kubelet (node certificate)
- kubelet (serving certificate, if [enabled](https://rancher.com/docs/rke/latest/en/config-options/services/#kubelet-options))
- kube-apiserver
- kube-proxy
- kube-scheduler
- kube-controller-manager
</TabItem>
<TabItem value="RKE2">
- admin
- api-server
- controller-manager
@@ -42,9 +28,6 @@ Certificates can be rotated for the following services:
- kubelet
- kube-proxy
</TabItem>
</Tabs>
:::note
For users who didn't rotate their webhook certificates, and they have expired after one year, please see this [page](../../../troubleshooting/other-troubleshooting-tips/expired-webhook-certificate-rotation.md) for help.
@@ -68,15 +51,4 @@ Rancher launched Kubernetes clusters have the ability to rotate the auto-generat
### Additional Notes
<Tabs>
<TabItem value="RKE">
Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher launched Kubernetes clusters.
</TabItem>
<TabItem value="RKE2">
In RKE2, both etcd and control plane nodes are treated as the same `server` concept. As such, when rotating certificates of services specific to either of these components will result in certificates being rotated on both. The certificates will only change for the specified service, but you will see nodes for both components go into an updating state. You may also see worker only nodes go into an updating state. This is to restart the workers after a certificate change to ensure they get the latest client certs.
</TabItem>
</Tabs>
In RKE2/K3s, both etcd and control plane nodes are treated as the same `server` concept. As such, when rotating certificates of services specific to either of these components will result in certificates being rotated on both. The certificates will only change for the specified service, but you will see nodes for both components go into an updating state. You may also see worker only nodes go into an updating state. This is to restart the workers after a certificate change to ensure they get the latest client certs.
docs/how-to-guides/new-user-guides/manage-clusters/rotate-encryption-key.md
+4 -33
View File
@@ -6,39 +6,11 @@ title: Encryption Key Rotation
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/manage-clusters/rotate-encryption-key"/>
</head>
### RKE1 Encryption Key Rotation
:::note Important
1. Enable encryption key rotation with either of the following two options:
Encryption key rotation is enabled by default and cannot be disabled.
- Select the `Enabled` radio button in the Rancher UI under **Cluster Options > Advanced Options > Secrets Encryption**:
![Enable Encryption Key Rotation](/img/rke1-enable-secrets-encryption.png)
- OR, apply the following YAML:
```yaml
rancher_kubernetes_engine_config:
services:
kube_api:
secrets_encryption_config:
enabled: true
```
2. Rotate keys in the Rancher UI:
2.1. Click **☰ > Cluster Management**.
2.2. Select **⋮ > Rotate Encryption Keys** on the far right of the screen next to your chosen cluster:
![Encryption Key Rotation](/img/rke1-encryption-key.png)
### RKE2 Encryption Key Rotation
_**New in v2.6.7**_
>**Important:** Encryption key rotation is enabled by default and cannot be disabled.
:::
To rotate keys in the Rancher UI:
@@ -48,5 +20,4 @@ To rotate keys in the Rancher UI:
![Encryption Key Rotation](/img/rke2-encryption-key.png)
>**Note:** For more information on RKE2 secrets encryption config, please see the [RKE2 docs](https://docs.rke2.io/security/secrets_encryption).
>**Note:** For more information on RKE2 secrets encryption config, please see the [RKE2 docs](https://docs.rke2.io/security/secrets_encryption).
i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/manage-clusters/rotate-certificates.md
+1 -29
View File
@@ -12,20 +12,6 @@ title: 证书轮换
可以为以下服务轮换证书：
<Tabs>
<TabItem value="RKE">
- etcd
- kubelet（节点证书）
- kubelet（服务证书，如果[启用](https://rancher.com/docs/rke/latest/en/config-options/services/#kubelet-options)）
- kube-apiserver
- kube-proxy
- kube-scheduler
- kube-controller-manager
</TabItem>
<TabItem value="RKE2">
- admin
- api-server
- controller-manager
@@ -38,9 +24,6 @@ title: 证书轮换
- kubelet
- kube-proxy
</TabItem>
</Tabs>
:::note
如果你未轮换 webhook 证书，且证书用了一年后已经过期，请参阅此[页面](../../../troubleshooting/other-troubleshooting-tips/expired-webhook-certificate-rotation.md)。
@@ -64,15 +47,4 @@ Rancher 启动的 Kubernetes 集群能够通过 UI 轮换自动生成的证书
## 补充说明
<Tabs>
<TabItem value="RKE">
虽然 RKE CLI 可以为 Kubernetes 集群组件使用自定义证书，但 Rancher 目前不允许在 Rancher 启动的 Kubernetes 集群中上传这些证书。
</TabItem>
<TabItem value="RKE2">
在 RKE2 中，etcd 和 controlplane 节点都被视为相同的 `server`。因此，如果你轮换其中一个组件的服务证书，则两者的证书都会被轮换。证书只会针对指定的服务更改，但你会看到两个组件的节点都进入更新状态。你可能还会看到仅 Worker 节点进入更新状态。这是在证书更改后重启 Worker，以确保他们获得最新的客户端证书。
</TabItem>
</Tabs>
在 RKE2/K3s 中，etcd 和 controlplane 节点都被视为相同的 `server`。因此，如果你轮换其中一个组件的服务证书，则两者的证书都会被轮换。证书只会针对指定的服务更改，但你会看到两个组件的节点都进入更新状态。你可能还会看到仅 Worker 节点进入更新状态。这是在证书更改后重启 Worker，以确保他们获得最新的客户端证书。
i18n/zh/docusaurus-plugin-content-docs/current/how-to-guides/new-user-guides/manage-clusters/rotate-encryption-key.md
+4 -33
View File
@@ -2,39 +2,11 @@
title: 加密密钥轮换
---
## RKE1 加密密钥轮换
:::note 重要
1. 使用以下两个选项之一来启用加密密钥轮换：
加密密钥轮换默认启用，不能禁用。
- 在 Rancher UI 中的 **Cluster Options > Advanced Options > Secrets Encryption** 下选择 `Enabled` 单选按钮：
![启用加密密钥轮换](/img/rke1-enable-secrets-encryption.png)
- 或者，应用以下 YAML：
```yaml
rancher_kubernetes_engine_config:
services:
kube_api:
secrets_encryption_config:
enabled: true
```
2. 在 Rancher UI 中轮换密钥：
2.1. 点击 **☰ > 集群管理**。
2.2. 在所选集群旁边的屏幕最右侧选择 **⋮ > Rotate Encryption Keys**：
![加密密钥轮换](/img/rke1-encryption-key.png)
## RKE2 加密密钥轮换
_**v2.6.7 新功能**_
> **重要提示**：加密密钥轮换默认启用，不能禁用。
:::
要在 Rancher UI 中轮换密钥：
@@ -44,5 +16,4 @@ _**v2.6.7 新功能**_
![加密密钥轮换](/img/rke2-encryption-key.png)
> **注意**：有关 RKE2 密文加密配置的更多信息，请参阅 [RKE2 文档](https://docs.rke2.io/security/secrets_encryption)。
> **注意**：有关 RKE2 密文加密配置的更多信息，请参阅 [RKE2 文档](https://docs.rke2.io/security/secrets_encryption)。
i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/manage-clusters/rotate-certificates.md
+1 -29
View File
@@ -12,20 +12,6 @@ title: 证书轮换
可以为以下服务轮换证书：
<Tabs>
<TabItem value="RKE">
- etcd
- kubelet（节点证书）
- kubelet（服务证书，如果[启用](https://rancher.com/docs/rke/latest/en/config-options/services/#kubelet-options)）
- kube-apiserver
- kube-proxy
- kube-scheduler
- kube-controller-manager
</TabItem>
<TabItem value="RKE2">
- admin
- api-server
- controller-manager
@@ -38,9 +24,6 @@ title: 证书轮换
- kubelet
- kube-proxy
</TabItem>
</Tabs>
:::note
如果你未轮换 webhook 证书，且证书用了一年后已经过期，请参阅此[页面](../../../troubleshooting/other-troubleshooting-tips/expired-webhook-certificate-rotation.md)。
@@ -64,15 +47,4 @@ Rancher 启动的 Kubernetes 集群能够通过 UI 轮换自动生成的证书
## 补充说明
<Tabs>
<TabItem value="RKE">
虽然 RKE CLI 可以为 Kubernetes 集群组件使用自定义证书，但 Rancher 目前不允许在 Rancher 启动的 Kubernetes 集群中上传这些证书。
</TabItem>
<TabItem value="RKE2">
在 RKE2 中，etcd 和 controlplane 节点都被视为相同的 `server`。因此，如果你轮换其中一个组件的服务证书，则两者的证书都会被轮换。证书只会针对指定的服务更改，但你会看到两个组件的节点都进入更新状态。你可能还会看到仅 Worker 节点进入更新状态。这是在证书更改后重启 Worker，以确保他们获得最新的客户端证书。
</TabItem>
</Tabs>
在 RKE2/K3s 中，etcd 和 controlplane 节点都被视为相同的 `server`。因此，如果你轮换其中一个组件的服务证书，则两者的证书都会被轮换。证书只会针对指定的服务更改，但你会看到两个组件的节点都进入更新状态。你可能还会看到仅 Worker 节点进入更新状态。这是在证书更改后重启 Worker，以确保他们获得最新的客户端证书。
i18n/zh/docusaurus-plugin-content-docs/version-2.12/how-to-guides/new-user-guides/manage-clusters/rotate-encryption-key.md
+4 -33
View File
@@ -2,39 +2,11 @@
title: 加密密钥轮换
---
## RKE1 加密密钥轮换
:::note 重要
1. 使用以下两个选项之一来启用加密密钥轮换：
加密密钥轮换默认启用，不能禁用。
- 在 Rancher UI 中的 **Cluster Options > Advanced Options > Secrets Encryption** 下选择 `Enabled` 单选按钮：
![启用加密密钥轮换](/img/rke1-enable-secrets-encryption.png)
- 或者，应用以下 YAML：
```yaml
rancher_kubernetes_engine_config:
services:
kube_api:
secrets_encryption_config:
enabled: true
```
2. 在 Rancher UI 中轮换密钥：
2.1. 点击 **☰ > 集群管理**。
2.2. 在所选集群旁边的屏幕最右侧选择 **⋮ > Rotate Encryption Keys**：
![加密密钥轮换](/img/rke1-encryption-key.png)
## RKE2 加密密钥轮换
_**v2.6.7 新功能**_
> **重要提示**：加密密钥轮换默认启用，不能禁用。
:::
要在 Rancher UI 中轮换密钥：
@@ -44,5 +16,4 @@ _**v2.6.7 新功能**_
![加密密钥轮换](/img/rke2-encryption-key.png)
> **注意**：有关 RKE2 密文加密配置的更多信息，请参阅 [RKE2 文档](https://docs.rke2.io/security/secrets_encryption)。
> **注意**：有关 RKE2 密文加密配置的更多信息，请参阅 [RKE2 文档](https://docs.rke2.io/security/secrets_encryption)。
versioned_docs/version-2.12/how-to-guides/new-user-guides/manage-clusters/rotate-certificates.md
+1 -29
View File
@@ -16,20 +16,6 @@ By default, Kubernetes clusters require certificates and Rancher launched Kubern
Certificates can be rotated for the following services:
<Tabs>
<TabItem value="RKE">
- etcd
- kubelet (node certificate)
- kubelet (serving certificate, if [enabled](https://rancher.com/docs/rke/latest/en/config-options/services/#kubelet-options))
- kube-apiserver
- kube-proxy
- kube-scheduler
- kube-controller-manager
</TabItem>
<TabItem value="RKE2">
- admin
- api-server
- controller-manager
@@ -42,9 +28,6 @@ Certificates can be rotated for the following services:
- kubelet
- kube-proxy
</TabItem>
</Tabs>
:::note
For users who didn't rotate their webhook certificates, and they have expired after one year, please see this [page](../../../troubleshooting/other-troubleshooting-tips/expired-webhook-certificate-rotation.md) for help.
@@ -68,15 +51,4 @@ Rancher launched Kubernetes clusters have the ability to rotate the auto-generat
### Additional Notes
<Tabs>
<TabItem value="RKE">
Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher launched Kubernetes clusters.
</TabItem>
<TabItem value="RKE2">
In RKE2, both etcd and control plane nodes are treated as the same `server` concept. As such, when rotating certificates of services specific to either of these components will result in certificates being rotated on both. The certificates will only change for the specified service, but you will see nodes for both components go into an updating state. You may also see worker only nodes go into an updating state. This is to restart the workers after a certificate change to ensure they get the latest client certs.
</TabItem>
</Tabs>
In RKE2/K3s, both etcd and control plane nodes are treated as the same `server` concept. As such, when rotating certificates of services specific to either of these components will result in certificates being rotated on both. The certificates will only change for the specified service, but you will see nodes for both components go into an updating state. You may also see worker only nodes go into an updating state. This is to restart the workers after a certificate change to ensure they get the latest client certs.
versioned_docs/version-2.12/how-to-guides/new-user-guides/manage-clusters/rotate-encryption-key.md
+4 -33
View File
@@ -6,39 +6,11 @@ title: Encryption Key Rotation
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/manage-clusters/rotate-encryption-key"/>
</head>
### RKE1 Encryption Key Rotation
:::note Important
1. Enable encryption key rotation with either of the following two options:
Encryption key rotation is enabled by default and cannot be disabled.
- Select the `Enabled` radio button in the Rancher UI under **Cluster Options > Advanced Options > Secrets Encryption**:
![Enable Encryption Key Rotation](/img/rke1-enable-secrets-encryption.png)
- OR, apply the following YAML:
```yaml
rancher_kubernetes_engine_config:
services:
kube_api:
secrets_encryption_config:
enabled: true
```
2. Rotate keys in the Rancher UI:
2.1. Click **☰ > Cluster Management**.
2.2. Select **⋮ > Rotate Encryption Keys** on the far right of the screen next to your chosen cluster:
![Encryption Key Rotation](/img/rke1-encryption-key.png)
### RKE2 Encryption Key Rotation
_**New in v2.6.7**_
>**Important:** Encryption key rotation is enabled by default and cannot be disabled.
:::
To rotate keys in the Rancher UI:
@@ -48,5 +20,4 @@ To rotate keys in the Rancher UI:
![Encryption Key Rotation](/img/rke2-encryption-key.png)
>**Note:** For more information on RKE2 secrets encryption config, please see the [RKE2 docs](https://docs.rke2.io/security/secrets_encryption).
>**Note:** For more information on RKE2 secrets encryption config, please see the [RKE2 docs](https://docs.rke2.io/security/secrets_encryption).