[Airship-discuss] Kubernetes Certificates Expiring, how to renew in Airship?

[Rhine, Jay (Nokia - US)]

Thank you!  We will give this a try

----
Jay Rhine, CISSP
DMTS, Solution Validation
Global Services Center
Nokia Software, Nokia
Email - Jay.Rhine at nokia.com
Home Office - 732-930-0380
________________________________
From: BOSE, ARIJIT <ab7180 at att.com>
Sent: Sunday, June 20, 2021 1:01:24 AM
To: Rhine, Jay (Nokia - US) <jay.rhine at nokia.com>; airship-discuss at lists.airshipit.org <airship-discuss at lists.airshipit.org>
Subject: RE: [Airship-discuss] Kubernetes Certificates Expiring, how to renew in Airship?


Hello Jay,



You can try using the below procedure to manually rotate the certificates for the Airship1 cluster.



https://review.opendev.org/c/airship/treasuremap/+/797183/1/tools/brownfield/Manual-Cert-Rotation.md



BR,

Arijit Bose



From: Rhine, Jay (Nokia - US) <jay.rhine at nokia.com>
Sent: Thursday, June 17, 2021 3:09 PM
To: BOSE, ARIJIT <ab7180 at att.com>; airship-discuss at lists.airshipit.org
Subject: RE: [Airship-discuss] Kubernetes Certificates Expiring, how to renew in Airship?



Hello!



               Our ingress certs expire often and we know how to replace them, but the system ones we are not sure on.  If you can share those steps, it would be great.



Thanks,



Jay



---

Jay Rhine, CISSP

DMTS, Solution Validation

Global Services Center

Nokia Software, Nokia

Email - Jay.Rhine at nokia.com<mailto:Jay.Rhine at nokia.com>



From: BOSE, ARIJIT <ab7180 at att.com<mailto:ab7180 at att.com>>
Sent: Thursday, June 17, 2021 3:45 PM
To: Rhine, Jay (Nokia - US) <jay.rhine at nokia.com<mailto:jay.rhine at nokia.com>>; airship-discuss at lists.airshipit.org<mailto:airship-discuss at lists.airshipit.org>
Subject: RE: [Airship-discuss] Kubernetes Certificates Expiring, how to renew in Airship?



Hello Jay,



Hope you are doing good.

We don’t have the cert-rotation scripts ready for upstream.



We shall share some steps to rotate the K8s certs shortly.



Also would request you to check the ingress cert expiration dates.



BR,

Arijit Bose

From: Rhine, Jay (Nokia - US) <jay.rhine at nokia.com<mailto:jay.rhine at nokia.com>>
Sent: Monday, June 14, 2021 10:58 AM
To: airship-discuss at lists.airshipit.org<mailto:airship-discuss at lists.airshipit.org>
Subject: Re: [Airship-discuss] Kubernetes Certificates Expiring, how to renew in Airship?



Hello!  I sent this after normal working hours for same last week, so I’ll resend this request again … any ideas are appreciated.



We have an airship system that we have been using, and we have noticed that many of the certificates in /etc/kubernetes will expire soon.  In particular, these certificates:



/etc/kubernetes/scheduler/scheduler.pem

/etc/kubernetes/admin/pki/admin.pem

/etc/kubernetes/controller-manager/controller-manager.pem

/etc/kubernetes/apiserver/apiserver-proxy-cert.pem

/etc/kubernetes/apiserver/pki/apiserver.pem

/etc/kubernetes/apiserver/pki/apiserver-both.pem

/etc/kubernetes/apiserver/pki/etcd-client.pem

/etc/kubernetes/apiserver/pki/kubelet-client.pem

/etc/kubernetes/pki/kubelet.pem



Is there a procedure, script, or guidance on how we can renew those certificates?  We looked around online a bit, and the generic procedures seemed to mostly refer to kubeadm, which I don’t think is being used by airship.



Any suggestions would be appreciated.



Thank you!



Jay



---

Jay Rhine, CISSP

DMTS, Solution Validation

Global Services Center

Nokia Software, Nokia

Email - Jay.Rhine at nokia.com<mailto:Jay.Rhine at nokia.com>



From: Rhine, Jay (Nokia - US)
Sent: Thursday, June 10, 2021 6:11 PM
To: airship-discuss at lists.airshipit.org<mailto:airship-discuss at lists.airshipit.org>
Subject: Kubernetes Certificates Expiring, how to renew in Airship?



Hello All!



We have an airship system that we have been using, and we have noticed that many of the certificates in /etc/kubernetes will expire soon.  In particular, these certificates:



/etc/kubernetes/scheduler/scheduler.pem

/etc/kubernetes/admin/pki/admin.pem

/etc/kubernetes/controller-manager/controller-manager.pem

/etc/kubernetes/apiserver/apiserver-proxy-cert.pem

/etc/kubernetes/apiserver/pki/apiserver.pem

/etc/kubernetes/apiserver/pki/apiserver-both.pem

/etc/kubernetes/apiserver/pki/etcd-client.pem

/etc/kubernetes/apiserver/pki/kubelet-client.pem

/etc/kubernetes/pki/kubelet.pem



Is there a procedure, script, or guidance on how we can renew those certificates?  We looked around online a bit, and the generic procedures seemed to mostly refer to kubeadm, which I don’t think is being used by airship.



Any suggestions would be appreciated.



Thank you!



Jay



---

Jay Rhine, CISSP

DMTS, Solution Validation

Global Services Center

Nokia Software, Nokia

Email - Jay.Rhine at nokia.com<mailto:Jay.Rhine at nokia.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.airshipit.org/pipermail/airship-discuss/attachments/20210620/f79a8923/attachment.html>