Hello!  I sent this after normal working hours for same last week, so I’ll resend this request again … any ideas are appreciated.

 

We have an airship system that we have been using, and we have noticed that many of the certificates in /etc/kubernetes will expire soon.  In particular, these certificates:

 

/etc/kubernetes/scheduler/scheduler.pem

/etc/kubernetes/admin/pki/admin.pem

/etc/kubernetes/controller-manager/controller-manager.pem

/etc/kubernetes/apiserver/apiserver-proxy-cert.pem

/etc/kubernetes/apiserver/pki/apiserver.pem

/etc/kubernetes/apiserver/pki/apiserver-both.pem

/etc/kubernetes/apiserver/pki/etcd-client.pem

/etc/kubernetes/apiserver/pki/kubelet-client.pem

/etc/kubernetes/pki/kubelet.pem

 

Is there a procedure, script, or guidance on how we can renew those certificates?  We looked around online a bit, and the generic procedures seemed to mostly refer to kubeadm, which I don’t think is being used by airship.

 

Any suggestions would be appreciated.

 

Thank you!

 

Jay

 

---

Jay Rhine, CISSP

DMTS, Solution Validation

Global Services Center

Nokia Software, Nokia

Email - Jay.Rhine@nokia.com

 

From: Rhine, Jay (Nokia - US)
Sent: Thursday, June 10, 2021 6:11 PM
To: airship-discuss@lists.airshipit.org
Subject: Kubernetes Certificates Expiring, how to renew in Airship?

 

Hello All!

 

We have an airship system that we have been using, and we have noticed that many of the certificates in /etc/kubernetes will expire soon.  In particular, these certificates:

 

/etc/kubernetes/scheduler/scheduler.pem

/etc/kubernetes/admin/pki/admin.pem

/etc/kubernetes/controller-manager/controller-manager.pem

/etc/kubernetes/apiserver/apiserver-proxy-cert.pem

/etc/kubernetes/apiserver/pki/apiserver.pem

/etc/kubernetes/apiserver/pki/apiserver-both.pem

/etc/kubernetes/apiserver/pki/etcd-client.pem

/etc/kubernetes/apiserver/pki/kubelet-client.pem

/etc/kubernetes/pki/kubelet.pem

 

Is there a procedure, script, or guidance on how we can renew those certificates?  We looked around online a bit, and the generic procedures seemed to mostly refer to kubeadm, which I don’t think is being used by airship.

 

Any suggestions would be appreciated.

 

Thank you!

 

Jay

 

---

Jay Rhine, CISSP

DMTS, Solution Validation

Global Services Center

Nokia Software, Nokia

Email - Jay.Rhine@nokia.com