[Airship-discuss] Kubernetes Certificates Expiring, how to renew in Airship?

[Rhine, Jay (Nokia - US)]

Hello!  I sent this after normal working hours for same last week, so I'll resend this request again ... any ideas are appreciated.

We have an airship system that we have been using, and we have noticed that many of the certificates in /etc/kubernetes will expire soon.  In particular, these certificates:

/etc/kubernetes/scheduler/scheduler.pem
/etc/kubernetes/admin/pki/admin.pem
/etc/kubernetes/controller-manager/controller-manager.pem
/etc/kubernetes/apiserver/apiserver-proxy-cert.pem
/etc/kubernetes/apiserver/pki/apiserver.pem
/etc/kubernetes/apiserver/pki/apiserver-both.pem
/etc/kubernetes/apiserver/pki/etcd-client.pem
/etc/kubernetes/apiserver/pki/kubelet-client.pem
/etc/kubernetes/pki/kubelet.pem

Is there a procedure, script, or guidance on how we can renew those certificates?  We looked around online a bit, and the generic procedures seemed to mostly refer to kubeadm, which I don't think is being used by airship.

Any suggestions would be appreciated.

Thank you!

Jay

---
Jay Rhine, CISSP
DMTS, Solution Validation
Global Services Center
Nokia Software, Nokia
Email - Jay.Rhine at nokia.com<mailto:Jay.Rhine at nokia.com>

From: Rhine, Jay (Nokia - US)
Sent: Thursday, June 10, 2021 6:11 PM
To: airship-discuss at lists.airshipit.org
Subject: Kubernetes Certificates Expiring, how to renew in Airship?

Hello All!

We have an airship system that we have been using, and we have noticed that many of the certificates in /etc/kubernetes will expire soon.  In particular, these certificates:

/etc/kubernetes/scheduler/scheduler.pem
/etc/kubernetes/admin/pki/admin.pem
/etc/kubernetes/controller-manager/controller-manager.pem
/etc/kubernetes/apiserver/apiserver-proxy-cert.pem
/etc/kubernetes/apiserver/pki/apiserver.pem
/etc/kubernetes/apiserver/pki/apiserver-both.pem
/etc/kubernetes/apiserver/pki/etcd-client.pem
/etc/kubernetes/apiserver/pki/kubelet-client.pem
/etc/kubernetes/pki/kubelet.pem

Is there a procedure, script, or guidance on how we can renew those certificates?  We looked around online a bit, and the generic procedures seemed to mostly refer to kubeadm, which I don't think is being used by airship.

Any suggestions would be appreciated.

Thank you!

Jay

---
Jay Rhine, CISSP
DMTS, Solution Validation
Global Services Center
Nokia Software, Nokia
Email - Jay.Rhine at nokia.com<mailto:Jay.Rhine at nokia.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.airshipit.org/pipermail/airship-discuss/attachments/20210614/ea6cee55/attachment.html>