kubernetes-sigs
/
kubespray
mirror of https://github.com/kubernetes-sigs/kubespray.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
kubespray/roles/kubernetes/control-plane/templates/k8s-certs-renew.timer.j2

12 lines
279 B
Plaintext
Raw Normal View History

Auto renew control plane certificates (#7358) While at it remove force_certificate_regeneration This boolean only forced the renewal of the apiserver certs Either manually use k8s-certs-renew.sh or set auto_renew_certificates Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-23 02:22:48 +08:00
[Unit]
Description=Timer to renew K8S control plane certificates
[Timer]
Add auto_renew_certificates_systemd_calendar (#7490) This allow to configure when K8S certificates renewal runs Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-04-13 00:47:45 +08:00
OnCalendar={{ auto_renew_certificates_systemd_calendar }}
Move control plane certs renewal "spread out" into the systemd timer (#10596) * Use RandomizedDelaySec to spread out control certificates renewal plane If the number of control plane node is superior to 6, using (index * 10 minutes) will fail (03:60:00 is not a valid timestamp). Compared to just fixing the jinja expression (to use a modulo for example), this should avoid having two control planes certificates update node being triggered at the same time. * Make k8s-certs-renew.timer Persistent If the control plane happens to be offline during the scheduled certificates renewal (node failure or anything like that), we still want the renewal to happen.
2023-11-08 19:35:20 +08:00
RandomizedDelaySec={{ 10 * (groups['kube_control_plane'] | length) }}min
FixedRandomDelay=yes
Persistent=yes
Auto renew control plane certificates (#7358) While at it remove force_certificate_regeneration This boolean only forced the renewal of the apiserver certs Either manually use k8s-certs-renew.sh or set auto_renew_certificates Signed-off-by: Etienne Champetier <e.champetier@ateme.com>
2021-03-23 02:22:48 +08:00
[Install]
WantedBy=multi-user.target