Renew expired kubeadm certs #16249
Renew expired kubeadm certs #16249
Conversation
k8s-ci-robot
added
the
cncf-cla: yes
k8s-ci-robot
added
approved
spowelljr
changed the title
k8s-ci-robot
added
the
do-not-merge/work-in-progress
spowelljr
changed the title
k8s-ci-robot
removed
the
do-not-merge/work-in-progress
|
/ok-to-test |
k8s-ci-robot
added
the
ok-to-test
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
| @@ -545,3 +576,31 @@ func isValid(certPath, keyPath string) bool { | |||
|
|
|||
| return true | |||
| } | |||
|
|
|||
| func isKubeadmCertValid(cmd command.Runner, certPath string) bool { | |||
There was a problem hiding this comment.
how about using linux to check if a cert is valid or not to avoid time zone difference between minikube and the host
Open a terminal window in Linux.
Type the following command, replacing <cert-file> with the path and name of the certificate file you want to check:
openssl x509 -enddate -noout -in <cert-file>
Press Enter.
The output of the command will display the end date of the certificate in the format notAfter=YYYYMMDDHHMMSSZ.
For example:
notAfter=20230410000000Z
Check the end date of the certificate. If the end date is in the past, then the certificate has expired.
For example, in the output above, the certificate will expire on April 10, 2023, at midnight UTC. If today's date is after April 10, 2023, then the certificate has expired.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
k8s-ci-robot
added
size/M
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: medyagh, spowelljr The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
|
kvm2 driver with docker runtime Times for minikube ingress: 28.7s 25.1s 27.6s 26.6s 28.6s Times for minikube start: 51.7s 47.4s 52.2s 48.4s 48.8s docker driver with docker runtime Times for minikube (PR 16249) start: 22.5s 21.8s 25.2s 22.6s 21.9s Times for minikube ingress: 22.4s 21.3s 20.8s 22.4s 21.4s docker driver with containerd runtime Times for minikube start: 20.6s 23.3s 21.6s 21.1s 22.6s Times for minikube ingress: 31.4s 31.3s 32.3s 19.3s 31.4s |
|
These are the flake rates of all failed tests.
To see the flake rates of all tests by environment, click here. |
Fixes #16201
Explanation for below commands in before and after:
When testing my changes I ran into the kubelet certs being expired. I found the following comment kubernetes/kubeadm#2054 (comment):
Manually forcing the date forward beyond kubelets certs expiration date was resulting in the certs not being rotated at all, so set the time less than a year, restart the kubelet service to force the certs rotation, then move time forward to make kubeadm certs be expired, but not far enough to make the kubelet certs expired. This would be handled for us if a cluster was running for a year.
Before:
After:
Is due to SSL certs being expired with forced time change