Issue with k8s.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/

[leo-baltus]

This is a Bug Report

Problem:
A cluster set-up using kubeadm needs a yearly certificate renewal procedure. This procedure consists of renewal of server certificates as well as client certificates. The client certificates renewal procedure is missing.

IMO after kubeadm alpha certs renew all either the client certificates in :
/etc/kubernetes/kubelet.conf, /etc/kubernetes/controller-manager.conf, /etc/kubernetes/scheduler.conf, /etc/kubernetes/admin.conf
should be renewed as well or the documentation should clearly suggest to renew clients certificates by doing:

cd /etc/kubernetes/
mv {admin.conf,controller-manager.conf,mv kubelet.conf,scheduler.conf} ~/
kubeadm init phase kubeconfig all

Proposed Solution:
I think that kubeadm alpha certs renew all should also update the client certificates.

Page to Update:
k8s.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/

v1.13.10

[sftim]

/sig cluster-lifecycle
Looks valid, I'll let someone from SIG Cluster Lifecycle make a call on this.

[neolit123]

1.13 is out if support. Please try 1.15 at minimum. I am pretty sure 'renew' updates .conf files in later versions.

…

On Mon, Dec 16, 2019, 14:08 Tim Bannister ***@***.***> wrote: /sig cluster-lifecycle Looks valid, I'll let someone from SIG Cluster Lifecycle make a call on this. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#18169?email_source=notifications&email_token=AACRATFNEGJ2YFK6WBEII63QY5VSZA5CNFSM4J3HYWGKYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEG6P6CY#issuecomment-566034187>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AACRATBUIJ3GV5J2W54OYILQY5VSZANCNFSM4J3HYWGA> .

[leo-baltus]

Upgraded step-by-step to v1.16.4. The client certificates seem all updated except /etc/kubernetes/kubelet.conf, which seems consistent with https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/

So I changed /etc/kubernetes/kubelet.conf:

KUBECONFIG=/etc/kubernetes/kubelet.conf kubectl config set-cluster kubernetes --certificate-authority=/etc/kubernetes/pki/ca.crt
KUBECONFIG=/etc/kubernetes/kubelet.conf kubectl config set-credentials system:node:$HOSTNAME \
  --client-certificate=/var/lib/kubelet/pki/kubelet-client-current.pem \
  --client-key=/var/lib/kubelet/pki/kubelet-client-current.pem

So, this issue can be closed. Thanks.

[neolit123]

/close

[k8s-ci-robot]

@neolit123: Closing this issue.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.