[WIP] An aspirational document on renewing certificates using kubeadm. #9712

liztio · 2018-08-01T21:09:37Z

Commands mentioned do not currently exist.

Part of kubernetes/kubeadm#206

Commands mentioned do not currently exist.

k8sio-netlify-preview-bot · 2018-08-01T21:13:18Z

Deploy preview for kubernetes-io-master-staging ready!

Built with commit ebe7c3e

https://deploy-preview-9712--kubernetes-io-master-staging.netlify.com

neolit123 · 2018-08-01T21:40:10Z

@liztio looks good, thanks.
perhaps we could have used google docs for the draft to allow collab edits?

do we have an associated issue in k/kubeadm?

neolit123 · 2018-08-01T21:40:22Z

/sig cluster-lifecycle

fabriziopandini · 2018-08-02T11:50:58Z

content/en/docs/tasks/administer-cluster/kubeadm/rotate-certs.md

+
+{{% capture steps %}}
+
+As part of upgrades, `kubeadm` will check all certificates it manages for expiration.


Does that means are you planning to change the upgrade process as well? currently, if I remember well it replaces only api server cert older than 180 days

Oh is that how it works? I was told is was "3 months from expiry," which I was able to prove wasn't the case.

That is my understanding of this code at least ...
https://github.com/kubernetes/kubernetes/blob/0c8fe56ea41d59b9f795949fbced9fde6ab422eb/cmd/kubeadm/app/phases/upgrade/postupgrade.go#L304

Agree with @fabriziopandini :)

fabriziopandini · 2018-08-02T12:00:03Z

content/en/docs/tasks/administer-cluster/kubeadm/rotate-certs.md

+
+[ca creation]: https://github.com/kubernetes/kubernetes/blob/release-1.11/staging/src/k8s.io/client-go/util/cert/cert.go#L72
+
+## Kubelet client certificates


@liztio might be I don't have all the info here, but why we need this if we are using Node certificate rotation via CSR auto-approved by the csrapprover controller?

I need review here from a security engineer. My thinking was a compromised certificate could allow the compromise to continue if we used the same trust paths. But maybe that's not a real risk factor?

liztio · 2018-08-02T15:22:06Z

@neolit123 kubernetes/kubeadm#206

timothysc

/approve

Generally lgtm other then we might want to call out some of our slack conversations on default expiration times.

timothysc · 2018-08-03T14:19:35Z

content/en/docs/tasks/administer-cluster/kubeadm/rotate-certs.md

+certs bootstrap created. Run `kubeadm phase certs renew kubelet --token <some token>
+```
+
+Run the provided command on all kubelet nodes. This re-bootstraps the trust from the master to the nodes. 


I wonder if we can automate this now via the dynamic kubelet jiggery.

/cc @mtaufen

k8s-ci-robot · 2018-08-03T14:21:00Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: timothysc
To fully approve this pull request, please assign additional approvers.
We suggest the following additional approver: steveperry-53

If they are not already assigned, you can assign the PR to them by writing /assign @steveperry-53 in a comment when ready.

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

kachkaev · 2018-08-03T22:36:01Z

Thanks for putting this together @liztio! Do you know if there is a way to rotate the certs after the kubeadm one got expired? If yes, it'd be great to have this described in the docs as may people may struggle with this (me in particular 😅)

xiangpengzhao · 2018-08-31T02:57:18Z

content/en/docs/tasks/administer-cluster/kubeadm/rotate-certs.md

+{{% capture steps %}}
+
+As part of upgrades, `kubeadm` will check all certificates it manages for expiration.
+If they are expiring within the next month, they will be replaced.


Does “the next month” mean 30 days or the next natural month?

xiangpengzhao · 2018-08-31T03:03:04Z

content/en/docs/tasks/administer-cluster/kubeadm/rotate-certs.md

+
+{{< warning >}}
+
+Kubernetes CAs do not support OCSP.


Might be good to write the full words of OCSP?

xiangpengzhao · 2018-08-31T03:08:17Z

content/en/docs/tasks/administer-cluster/kubeadm/rotate-certs.md

+
+```
+$ kubeadm phase certs renew master
+certs bootstrap created. Run `kubeadm phase certs renew kubelet --token <some token>


Missing a ` at the end

Automatic merge from submit-queue (batch tested with PRs 64283, 67910, 67803, 68100). If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md. Kubeadm Cert Renewal **What this PR does / why we need it**: adds explicit support for renewal of certificates via command **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*: Fixes kubernetes/kubeadm#206 **Special notes for your reviewer**: The targeted documentation is at kubernetes/website#9712 **Release note**: ```release-note Adds the commands `kubeadm alpha phases renew <cert-name>` ```

Automatic merge from submit-queue (batch tested with PRs 64283, 67910, 67803, 68100). If you want to cherry-pick this change to another branch, please follow the instructions here: https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md. Kubeadm Cert Renewal **What this PR does / why we need it**: adds explicit support for renewal of certificates via command **Which issue(s) this PR fixes** *(optional, in `fixes #<issue number>(, fixes #<issue_number>, ...)` format, will close the issue(s) when PR gets merged)*: Fixes kubernetes/kubeadm#206 **Special notes for your reviewer**: The targeted documentation is at kubernetes/website#9712 **Release note**: ```release-note Adds the commands `kubeadm alpha phases renew <cert-name>` ``` Kubernetes-commit: 17dde46baebe0b67421132af7b99b42d89ea4cd0

zacharysarah · 2018-09-24T22:16:04Z

@liztio 👋 Thanks for this PR! It looks like the last activity here was 18 days ago. Please feel free to reopen this PR when you're ready to address review feedback and drop [WIP] from the PR title.

[WIP] An aspirational document on renewing certificates using kubeadm.

ebe7c3e

Commands mentioned do not currently exist.

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 1, 2018

k8s-ci-robot requested review from Rajakavitha1 and stewart-yu August 1, 2018 21:09

k8s-ci-robot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Aug 1, 2018

k8s-ci-robot added the sig/cluster-lifecycle Categorizes an issue or PR as relevant to SIG Cluster Lifecycle. label Aug 1, 2018

fabriziopandini reviewed Aug 2, 2018

View reviewed changes

timothysc approved these changes Aug 3, 2018

View reviewed changes

k8s-ci-robot requested a review from mtaufen August 3, 2018 14:20

liztio mentioned this pull request Aug 27, 2018

Kubeadm Cert Renewal kubernetes/kubernetes#67910

Merged

xiangpengzhao reviewed Aug 31, 2018

View reviewed changes

zacharysarah added Tech Review LGTM labels Sep 24, 2018

zacharysarah closed this Sep 24, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[WIP] An aspirational document on renewing certificates using kubeadm. #9712

[WIP] An aspirational document on renewing certificates using kubeadm. #9712

liztio commented Aug 1, 2018 •

edited

k8sio-netlify-preview-bot commented Aug 1, 2018

neolit123 commented Aug 1, 2018

neolit123 commented Aug 1, 2018

fabriziopandini Aug 2, 2018

liztio Aug 2, 2018

fabriziopandini Aug 3, 2018

xiangpengzhao Aug 31, 2018

fabriziopandini Aug 2, 2018

liztio Aug 2, 2018

liztio commented Aug 2, 2018

timothysc left a comment

timothysc Aug 3, 2018

k8s-ci-robot commented Aug 3, 2018

kachkaev commented Aug 3, 2018

xiangpengzhao Aug 31, 2018

xiangpengzhao Aug 31, 2018

xiangpengzhao Aug 31, 2018

zacharysarah commented Sep 24, 2018


		{{% capture steps %}}

		As part of upgrades, `kubeadm` will check all certificates it manages for expiration.


		[ca creation]: https://github.com/kubernetes/kubernetes/blob/release-1.11/staging/src/k8s.io/client-go/util/cert/cert.go#L72

		## Kubelet client certificates

[WIP] An aspirational document on renewing certificates using kubeadm. #9712

[WIP] An aspirational document on renewing certificates using kubeadm. #9712

Conversation

liztio commented Aug 1, 2018 • edited

k8sio-netlify-preview-bot commented Aug 1, 2018

neolit123 commented Aug 1, 2018

neolit123 commented Aug 1, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

liztio commented Aug 2, 2018

timothysc left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

k8s-ci-robot commented Aug 3, 2018

kachkaev commented Aug 3, 2018

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zacharysarah commented Sep 24, 2018

liztio commented Aug 1, 2018 •

edited