kubernetes
/
website
mirror of https://github.com/kubernetes/website.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

kubeadm: include a couple of workarounds in kubeadm-certs.md (#16726) 

* kubeadm: include a couple of workarounds in kubeadm-certs.md

- add warning about --certificate-renewal=false bug.
- add warning about disable kubelet cert rotation on "init" nodes.

* Update content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md

Co-Authored-By: Tim Bannister <tim@scalefactory.com>
This commit is contained in:
Lubomir I. Ivanov 2019-10-12 12:26:38 +03:00 committed by Kubernetes Prow Robot
parent 36f4d27136
commit 742880937b
1 changed files with 19 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md
View File

@ -59,11 +59,22 @@ Additionally, kubeadm informs the user if the certificate is externally managed;
`kubelet.conf` is not included in the list above because kubeadm configures kubelet for automatic certificate renewal.
{{< /note >}}
{{< warning >}}
On nodes created with `kubeadm init`, prior to kubeadm version 1.17, there is a
[bug](https://github.com/kubernetes/kubeadm/issues/1753) where you manually have to modify the contents of `kubelet.conf`. After `kubeadm init` finishes, you should update `kubelet.conf` to point to the
rotated kubelet client certificates, by replacing `client-certificate-data` and `client-key-data` with:
```yaml
client-certificate: /var/lib/kubelet/pki/kubelet-client-current.pem
client-key: /var/lib/kubelet/pki/kubelet-client-current.pem
```
{{< /warning >}}
## Automatic certificate renewal
`kubeadm` renews all the certificates during control plane [upgrade](/docs/tasks/administer-cluster/kubeadm/kubeadm-upgrade/).
This feature is designed for addressing the simplest use cases;
This feature is designed for addressing the simplest use cases;
if you don't have specific requirements on certificate renewal and perform Kubernetes version upgrades regularly (less than 1 year in between each upgrade), kubeadm will take care of keeping your cluster up to date and reasonably secure.
{{< note >}}
@ -72,6 +83,11 @@ It is a best practice to upgrade your cluster frequently in order to stay secure
If you have more complex requirements for certificate renewal, you can opt out from the default behavior by passing `--certificate-renewal=false` to `kubeadm upgrade apply` or to `kubeadm upgrade node`.
{{< warning >}}
Prior to kubeadm version 1.17 there is a [bug](https://github.com/kubernetes/kubeadm/issues/1818)
where the default value for `--certificate-renewal` is `false` for the `kubeadm upgrade node`
command. In that case, you should explicitly set `--certificate-renewal=true`.
{{< /warning >}}
## Manual certificate renewal
@ -110,7 +126,7 @@ You can configure an external signer such as [cert-manager][cert-manager-issuer]
The built-in signer is part of [`kube-controller-manager`][kcm].
To activate the built-in signer, you pass the `--cluster-signing-cert-file` and `--cluster-signing-key-file` arguments.
The built-in signer is part of [`kube-controller-manager`][kcm].
The built-in signer is part of [`kube-controller-manager`][kcm].
To activate the built-in signer, you must pass the `--cluster-signing-cert-file` and `--cluster-signing-key-file` flags.
@ -150,7 +166,7 @@ The output is similar to this:
If you set up an external signer, certificate signing requests (CSRs) are automatically approved.
Otherwise, you must manually approve certificates with the [`kubectl certificate`][certs] command. e.g.
Otherwise, you must manually approve certificates with the [`kubectl certificate`][certs] command. e.g.
```shell
kubectl certificate approve kubeadm-cert-kube-apiserver-ld526