From 74d5e12befc92b7bc7f9991a872ab0a7c39af884 Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 29 Oct 2021 16:14:35 -0400 Subject: [PATCH 1/5] Added link to TS homepage --- content/rancher/v2.6/en/troubleshooting/_index.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/rancher/v2.6/en/troubleshooting/_index.md b/content/rancher/v2.6/en/troubleshooting/_index.md index 8ca90f02fbd..554d6d46fb7 100644 --- a/content/rancher/v2.6/en/troubleshooting/_index.md +++ b/content/rancher/v2.6/en/troubleshooting/_index.md @@ -39,3 +39,7 @@ This section contains information to help you troubleshoot issues when using Ran - [User ID Tracking in Audit Logs]({{}}/rancher/v2.6/en/troubleshooting/userid-tracking-in-audit-logs/) Read more about how a Rancher Admin can trace an event from the Rancher audit logs and into the Kubernetes audit logs using the external Identity Provider username. + +- [Expired Webhook Certificates]({{}}/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/) + + Read more about how to rotate Rancher webhook certificate secret after it expires on an annual basis. From a740c979194fcc8980a97789774968c5628010be Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 29 Oct 2021 17:18:14 -0400 Subject: [PATCH 2/5] Updated wording --- content/rancher/v2.6/en/troubleshooting/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/rancher/v2.6/en/troubleshooting/_index.md b/content/rancher/v2.6/en/troubleshooting/_index.md index 554d6d46fb7..47448e25c17 100644 --- a/content/rancher/v2.6/en/troubleshooting/_index.md +++ b/content/rancher/v2.6/en/troubleshooting/_index.md @@ -42,4 +42,4 @@ This section contains information to help you troubleshoot issues when using Ran - [Expired Webhook Certificates]({{}}/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/) - Read more about how to rotate Rancher webhook certificate secret after it expires on an annual basis. + Read more about how to rotate a Rancher webhook certificate secret after it expires on an annual basis. From d08fe64710b98168339125bcbfb65ab9b43a0e0c Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 29 Oct 2021 17:18:41 -0400 Subject: [PATCH 3/5] Added new page for webhook expiration issue --- .../expired-webhook-certificates/_index.md | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 content/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/_index.md diff --git a/content/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/_index.md b/content/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/_index.md new file mode 100644 index 00000000000..e8e091d6b85 --- /dev/null +++ b/content/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/_index.md @@ -0,0 +1,22 @@ +--- +title: Rotation of Expired Webhook Certificates +weight: 120 +--- + +For Rancher versions that have `rancher-webhook` installed, these certificates will expire after one year. It will be necessary for you to rotate your webhook certificate when this occurs. + +Rancher will advise the community once there is a permanent solution in place for this known issue. Currently, there are two methods to work around this issue: + +##### 1. Users with cluster access, run the following commands: +``` +kubectl delete secret -n cattle-system cattle-webhook-tls +kubectl delete pod -n cattle-system -l app=rancher-webhook +``` + +##### 2. Users with no cluster access via `kubectl` + +1. Delete the `cattle-webhook-tls` secret in the `cattle-system` namespace in the local cluster. + +1. Delete the `rancher-webhook` pod in the `cattle-system` namespace in the local cluster. + +> **Note:** The webhook certificate expiration issue is not specific to `cattle-webhook-tls` as listed in the examples. You will fill in your expired certificate secret accordingly. \ No newline at end of file From 0170dd048a9150b63b115c3b50834172d1cbf45b Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Fri, 29 Oct 2021 17:35:10 -0400 Subject: [PATCH 4/5] Added note on cert rotation and link to new page --- .../v2.6/en/cluster-admin/certificate-rotation/_index.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md b/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md index 30ed0bde851..38eb69b8cb1 100644 --- a/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md +++ b/content/rancher/v2.6/en/cluster-admin/certificate-rotation/_index.md @@ -16,3 +16,5 @@ Certificates can be rotated for the following services: - kube-scheduler - kube-controller-manager +> **Note:** For users who didn't rotate their webhook certificates, and they have expired after one year, please see this [page]({{}}/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/) for help. + From 09e0fe5174097a20a92644dab107aa984c6528ee Mon Sep 17 00:00:00 2001 From: Jennifer Travinski Date: Tue, 2 Nov 2021 09:42:47 -0400 Subject: [PATCH 5/5] Added punctuation, adjusted markdown in note --- .../en/troubleshooting/expired-webhook-certificates/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/_index.md b/content/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/_index.md index e8e091d6b85..99979410992 100644 --- a/content/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/_index.md +++ b/content/rancher/v2.6/en/troubleshooting/expired-webhook-certificates/_index.md @@ -13,10 +13,10 @@ kubectl delete secret -n cattle-system cattle-webhook-tls kubectl delete pod -n cattle-system -l app=rancher-webhook ``` -##### 2. Users with no cluster access via `kubectl` +##### 2. Users with no cluster access via `kubectl`: 1. Delete the `cattle-webhook-tls` secret in the `cattle-system` namespace in the local cluster. 1. Delete the `rancher-webhook` pod in the `cattle-system` namespace in the local cluster. -> **Note:** The webhook certificate expiration issue is not specific to `cattle-webhook-tls` as listed in the examples. You will fill in your expired certificate secret accordingly. \ No newline at end of file +**Note:** The webhook certificate expiration issue is not specific to `cattle-webhook-tls` as listed in the examples. You will fill in your expired certificate secret accordingly. \ No newline at end of file