public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 04:28:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3638 from jtravee/Webhook-cert

Browse Source 
Added webhook cert expiration workaround
This commit is contained in:
Jen Travinski
2021-11-02 11:54:13 -04:00
committed by GitHub
parent 1100eaa774 09e0fe5174
commit cc9a432019
3 changed files with 28 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md
+2
View File
@@ -16,3 +16,5 @@ Certificates can be rotated for the following services:
- kube-scheduler
- kube-controller-manager
> **Note:** For users who didn't rotate their webhook certificates, and they have expired after one year, please see this [page]({{<baseurl>}}/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/) for help.
content/rancher/v2.6/en/troubleshooting/_index.md
+4
View File
@@ -39,3 +39,7 @@ This section contains information to help you troubleshoot issues when using Ran
- [User ID Tracking in Audit Logs]({{<baseurl>}}/rancher/v2.6/en/troubleshooting/userid-tracking-in-audit-logs/)
Read more about how a Rancher Admin can trace an event from the Rancher audit logs and into the Kubernetes audit logs using the external Identity Provider username.
- [Expired Webhook Certificates]({{<baseurl>}}/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/)
Read more about how to rotate a Rancher webhook certificate secret after it expires on an annual basis.
content/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/_index.md
+22
View File
@@ -0,0 +1,22 @@
---
title: Rotation of Expired Webhook Certificates
weight: 120
---
For Rancher versions that have `rancher-webhook` installed, these certificates will expire after one year. It will be necessary for you to rotate your webhook certificate when this occurs.
Rancher will advise the community once there is a permanent solution in place for this known issue. Currently, there are two methods to work around this issue:
##### 1. Users with cluster access, run the following commands:
```
kubectl delete secret -n cattle-system cattle-webhook-tls
kubectl delete pod -n cattle-system -l app=rancher-webhook
```
##### 2. Users with no cluster access via `kubectl`:
1. Delete the `cattle-webhook-tls` secret in the `cattle-system` namespace in the local cluster.
1. Delete the `rancher-webhook` pod in the `cattle-system` namespace in the local cluster.
**Note:** The webhook certificate expiration issue is not specific to `cattle-webhook-tls` as listed in the examples. You will fill in your expired certificate secret accordingly.