public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 12:38:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1928 from btat/v2.12.0-rke1-removal-cert-encryption

Browse Source 
Remove RKE1 references: rotate certs and encryption keys
This commit is contained in:
Sunil Singh
2025-07-30 18:02:42 -07:00
committed by GitHub
parent 817895d94c 67a549b289
commit c9b36076a5
8 changed files with 20 additions and 248 deletions
Download Patch File Download Diff File Expand all files Collapse all files
versioned_docs/version-2.12/how-to-guides/new-user-guides/manage-clusters/rotate-certificates.md
+1 -29
View File
@@ -16,20 +16,6 @@ By default, Kubernetes clusters require certificates and Rancher launched Kubern
Certificates can be rotated for the following services:
<Tabs>
<TabItem value="RKE">
- etcd
- kubelet (node certificate)
- kubelet (serving certificate, if [enabled](https://rancher.com/docs/rke/latest/en/config-options/services/#kubelet-options))
- kube-apiserver
- kube-proxy
- kube-scheduler
- kube-controller-manager
</TabItem>
<TabItem value="RKE2">
- admin
- api-server
- controller-manager
@@ -42,9 +28,6 @@ Certificates can be rotated for the following services:
- kubelet
- kube-proxy
</TabItem>
</Tabs>
:::note
For users who didn't rotate their webhook certificates, and they have expired after one year, please see this [page](../../../troubleshooting/other-troubleshooting-tips/expired-webhook-certificate-rotation.md) for help.
@@ -68,15 +51,4 @@ Rancher launched Kubernetes clusters have the ability to rotate the auto-generat
### Additional Notes
<Tabs>
<TabItem value="RKE">
Even though the RKE CLI can use custom certificates for the Kubernetes cluster components, Rancher currently doesn't allow the ability to upload these in Rancher launched Kubernetes clusters.
</TabItem>
<TabItem value="RKE2">
In RKE2, both etcd and control plane nodes are treated as the same `server` concept. As such, when rotating certificates of services specific to either of these components will result in certificates being rotated on both. The certificates will only change for the specified service, but you will see nodes for both components go into an updating state. You may also see worker only nodes go into an updating state. This is to restart the workers after a certificate change to ensure they get the latest client certs.
</TabItem>
</Tabs>
In RKE2/K3s, both etcd and control plane nodes are treated as the same `server` concept. As such, when rotating certificates of services specific to either of these components will result in certificates being rotated on both. The certificates will only change for the specified service, but you will see nodes for both components go into an updating state. You may also see worker only nodes go into an updating state. This is to restart the workers after a certificate change to ensure they get the latest client certs.
versioned_docs/version-2.12/how-to-guides/new-user-guides/manage-clusters/rotate-encryption-key.md
+4 -33
View File
@@ -6,39 +6,11 @@ title: Encryption Key Rotation
<link rel="canonical" href="https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/manage-clusters/rotate-encryption-key"/>
</head>
### RKE1 Encryption Key Rotation
:::note Important
1. Enable encryption key rotation with either of the following two options:
Encryption key rotation is enabled by default and cannot be disabled.
- Select the `Enabled` radio button in the Rancher UI under **Cluster Options > Advanced Options > Secrets Encryption**:
![Enable Encryption Key Rotation](/img/rke1-enable-secrets-encryption.png)
- OR, apply the following YAML:
```yaml
rancher_kubernetes_engine_config:
services:
kube_api:
secrets_encryption_config:
enabled: true
```
2. Rotate keys in the Rancher UI:
2.1. Click **☰ > Cluster Management**.
2.2. Select **⋮ > Rotate Encryption Keys** on the far right of the screen next to your chosen cluster:
![Encryption Key Rotation](/img/rke1-encryption-key.png)
### RKE2 Encryption Key Rotation
_**New in v2.6.7**_
>**Important:** Encryption key rotation is enabled by default and cannot be disabled.
:::
To rotate keys in the Rancher UI:
@@ -48,5 +20,4 @@ To rotate keys in the Rancher UI:
![Encryption Key Rotation](/img/rke2-encryption-key.png)
>**Note:** For more information on RKE2 secrets encryption config, please see the [RKE2 docs](https://docs.rke2.io/security/secrets_encryption).
>**Note:** For more information on RKE2 secrets encryption config, please see the [RKE2 docs](https://docs.rke2.io/security/secrets_encryption).