kubernetes-sigs
/
kubespray
mirror of https://github.com/kubernetes-sigs/kubespray.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Move control plane certs renewal "spread out" into the systemd timer (#10596) 

* Use RandomizedDelaySec to spread out control certificates renewal plane

If the number of control plane node is superior to 6, using (index * 10
minutes) will fail (03:60:00 is not a valid timestamp).

Compared to just fixing the jinja expression (to use a modulo for
example), this should avoid having two control planes certificates
update node being triggered at the same time.

* Make k8s-certs-renew.timer Persistent

If the control plane happens to be offline during the scheduled
certificates renewal (node failure or anything like that), we still want
the renewal to happen.
pull/10606/head
Max Gautier 2023-11-08 12:35:20 +01:00 committed by GitHub
parent 8ebeb88e57
commit b3f6d05131
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
roles/kubernetes/control-plane/defaults/main/main.yml
View File

@ -222,8 +222,7 @@ event_ttl_duration: "1h0m0s"
## Automatically renew K8S control plane certificates on first Monday of each month ## Automatically renew K8S control plane certificates on first Monday of each month
auto_renew_certificates: false auto_renew_certificates: false
# First Monday of each month # First Monday of each month
auto_renew_certificates_systemd_calendar: "{{ 'Mon *-*-1,2,3,4,5,6,7 03:' ~ auto_renew_certificates_systemd_calendar: "Mon *-*-1,2,3,4,5,6,7 03:00:00"
groups['kube_control_plane'].index(inventory_hostname) ~ '0:00' }}"
# kubeadm renews all the certificates during control plane upgrade. # kubeadm renews all the certificates during control plane upgrade.
# If we have requirement like without renewing certs upgrade the cluster, # If we have requirement like without renewing certs upgrade the cluster,
# we can opt out from the default behavior by setting kubeadm_upgrade_auto_cert_renewal to false # we can opt out from the default behavior by setting kubeadm_upgrade_auto_cert_renewal to false

3
roles/kubernetes/control-plane/templates/k8s-certs-renew.timer.j2
View File

@ -3,6 +3,9 @@ Description=Timer to renew K8S control plane certificates
[Timer] [Timer]
OnCalendar={{ auto_renew_certificates_systemd_calendar }} OnCalendar={{ auto_renew_certificates_systemd_calendar }}
RandomizedDelaySec={{ 10 * (groups['kube_control_plane'] | length) }}min
FixedRandomDelay=yes
Persistent=yes
[Install] [Install]
WantedBy=multi-user.target WantedBy=multi-user.target