feat: disabling newly added kubelet serving certificate rotation #466
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
we'll need to come up with a way Karpenter can determine when it's safe to enable this flag |
|
will probably end up deploying the required plugin whenever karpenter is enabled to ensure this flag is safe to set, for now will keep as false until the new plugin as rolled out |
Pull Request Test Coverage Report for Build 10532706044Details
💛 - Coveralls |
|
one thing to also note, Karpenter will need to make sure to not pass --tls-cert-file and --tls-private-key-file as kubelet flags when this is enabled, and obviously pass --rotate-server-certificates |
Bryce-Soghigian
commented
Aug 23, 2024
|
Why do we need to do anything to preserve the current functionality? The support for |
tallaxes
added
area/bootstrap
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes #
Description
This PR in AgentBaker enables the kubelet flag
--rotate-server-certificateskubelet flag. This flag will auto request and rotate the kubelet serving certificates by requesting new certs from the apiserverscertificates.k8s.ioapigroup when a certificate expiration approaches. This also requires the RotateKubeletServerCertificate feature gate to be enabled. The existing model just self signs the certificates.In terms of the karpenter impact, we are just going to stick with self signed certificates for now since we don't have everything configured to leverage this functionality.
How was this change tested?
Does this change impact docs?
Release Note