Rotate kubelet self-signed certificate #7322
Conversation
Looking at k8s code I can only see code generating kubelet self-signed cert but nothing rotating it. https://github.com/kubernetes/kubernetes/blob/e7cc2117a02bc5c74a8235a2725834b1841c459e/cmd/kubelet/app/server.go#L985-L990 Just delete the cert and let kubelet recreate it Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
k8s-ci-robot
added
kind/feature
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: champtar The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
size/XS
|
/hold let's wait for comment in the k8s ticket |
k8s-ci-robot
added
the
do-not-merge/hold
|
Btw why do you do that when |
| @@ -11,6 +11,9 @@ Wants={{ container_manager }}.service | |||
| [Service] | |||
| User=root | |||
| EnvironmentFile=-{{ kube_config_dir }}/kubelet.env | |||
| {% if not kubelet_rotate_server_certificates %} | |||
There was a problem hiding this comment.
It would be better to handle this like this:
{% if kubelet_rotate_server_certificates | default(false) %}
unless the policy is to have everything defined in defaults - even then, this would be a safe choice
EDIT: unless the default should be true, of course
There was a problem hiding this comment.
kubelet_rotate_server_certificates already exists to enable RotateKubeletServerCertificate
https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-tls-bootstrapping/#certificate-rotation
We can't enable it by default because k8s doesn't approve kubelet CSR by default for security reasons, so you need some extra components
When it's disabled, kubelet generate a self-signed cert that is never regenerated. This is not really a problem because it's not checked at all.
The idea of this PR was to delete this self-signed cert so it's regenerated, but not sure it really provide any value
Looking at k8s code I can only see code generating kubelet
self-signed cert but nothing rotating it.
https://github.com/kubernetes/kubernetes/blob/e7cc2117a02bc5c74a8235a2725834b1841c459e/cmd/kubelet/app/server.go#L985-L990
Just delete the cert and let kubelet recreate it
What type of PR is this?
/kind feature
What this PR does / why we need it:
Which issue(s) this PR fixes:
Fixes kubernetes/kubernetes#99418
Special notes for your reviewer:
Does this PR introduce a user-facing change?: