1. Documentation
×

Node certificates

Manage node certificates in OKD, including understanding their purpose for kubelet-API server communication, automatic rotation schedule, and how to manually renew the kubelet CA certificate.

Node certificates are signed by the cluster and allow the kubelet to communicate with the Kubernetes API server. They come from the kubelet CA certificate, which is generated by the bootstrap process.

The kubelet CA certificate is located in the kube-apiserver-to-kubelet-signer secret in the openshift-kube-apiserver-operator namespace.

These certificates are managed by the system and not the user and are automatically rotated after 30 days.

Renewing node certificates

Although the kubelet CA certificate automatically renews at 292 days, you can manually trigger renewal earlier by annotating the kube-apiserver-to-kubelet-signer secret.

The old CA certificate is removed after 365 days. Nodes are not rebooted when a kubelet CA certificate is renewed or removed.

Procedure

  • Annotate the secret to trigger manual renewal by running the following command:

    $ oc annotate -n openshift-kube-apiserver-operator secret kube-apiserver-to-kubelet-signer auth.openshift.io/certificate-not-after-

Additional resources