manual rotation of CA certificates (#15444 and #19165) #19351

abhiTamrakar · 2020-02-27T18:41:54Z

This PR is meant to address the steps for manual rotation of CA certificates.

Preview link: https://deploy-preview-19351--kubernetes-io-master-staging.netlify.com/docs/tasks/tls/manual-rotation-of-ca-certificates/

k8s-ci-robot · 2020-02-27T18:41:57Z

Thanks for your pull request. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

📝 Please follow instructions at https://git.k8s.io/community/CLA.md#the-contributor-license-agreement to sign the CLA.

It may take a couple minutes for the CLA signature to be fully registered; after that, please reply here with a new comment and we'll verify. Thanks.

If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
If you signed the CLA as a corporation, please sign in with your organization's credentials at https://identity.linuxfoundation.org/projects/cncf to be authorized.
If you have done the above and are still having issues with the CLA being reported as unsigned, please log a ticket with the Linux Foundation Helpdesk: https://support.linuxfoundation.org/
Should you encounter any issues with the Linux Foundation Helpdesk, send a message to the backup e-mail support address at: [email protected]

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

k8s-ci-robot · 2020-02-27T18:42:02Z

Welcome @abhiTamrakar!

It looks like this is your first PR to kubernetes/website 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/website has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

netlify · 2020-02-27T18:46:14Z

Deploy preview for kubernetes-io-master-staging ready!

Built with commit de57586

https://deploy-preview-19351--kubernetes-io-master-staging.netlify.app

zacharysarah

@abhiTamrakar Thanks for this addition, this is great! ✨ Seriously, this is one of the best new pages I've worked on in some time. I don't often get to work directly with page content, so thanks for making this a pleasure.

Thanks especially for following the style guide and adding callouts and capture statements. 👍

Some grammar and formatting fixes, otherwise LGTM from a docs perspective.

Note that Markdown only requires single back ticks for in-line code fencing. No need to add ```three```.

content/en/docs/tasks/tls/manual-rotation-of-ca-certificates.md

jimangel · 2020-02-28T21:35:57Z

This is awesome! Thanks!

I think it would be worth having a quick tech review from @kubernetes/sig-cluster-lifecycle. While not directly related, it would be good to validate any disclaimers / pitfalls for performing manual CA rotation as documented.

content/en/docs/tasks/tls/manual-rotation-of-ca-certificates.md

neolit123 · 2020-02-28T23:46:29Z

thanks for sending this PR @abhiTamrakar .

@kubernetes/sig-auth-pr-reviews

we need to establish the best practice for CA rotation, even if quite manual.
currently users outside of managed solutions are left in the dark in terms of how they are supposed to rotate CA - what are the recommendation and what is the sequence of actions.

please advise on the way forward and whether this document is something that we should include.

sftim · 2020-02-29T17:31:13Z

To let Prow understand your intentions @abhiTamrakar I am going to update the PR title to match conventions:
/retitle [WIP] manual rotation of CA certificates (#15444 and #19165)

sftim

Good work @abhiTamrakar

Here's some feedback, including suggestions you can accept if you're happy to.

content/en/docs/tasks/tls/manual-rotation-of-ca-certificates.md

abhiTamrakar · 2020-02-29T19:01:22Z

@zacharysarah 'a' were not getting parsed properly in the ordered list (https://github.com/kubernetes/website/pull/19351/files#diff-f7024f94c2d9c79b0e5ce9a9c0f8aaa7R111) So i changed it to numbers in the nested lists as well.
Sorry, I am not an expert in markdown, tried few other combinations for using roman numerals 'i' and versioned '1.1' with no better luck on my local machine.

content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md

sftim · 2020-02-29T19:05:52Z

The preview is https://deploy-preview-19351--kubernetes-io-master-staging.netlify.com/docs/tasks/tls/manual-rotation-of-ca-certificates/

(@abhiTamrakar - once I know what the URL of the preview page is for my changes, I typically amend the PR description to include a link)

content/en/docs/tasks/tls/manual-rotation-of-ca-certificates.md

abhiTamrakar · 2020-05-25T17:11:59Z

@sftim thanks for helping hand, @neolit123 advise worked, I knew about reset hard just forgot about git reflog.
Thanks @neolit123

I removed the labels that got added as part of the rebase with upstream.

abhiTamrakar · 2020-05-25T17:14:47Z

@micahhausler @deads2k review please.
@sftim I squashed earlier, is it looking good now?

sftim · 2020-05-25T17:22:48Z

@abhiTamrakar after squashing and pushing you should see that https://github.com/kubernetes/website/pull/19351/commits is just one commit

It does not look as if you have squashed and force-pushed

sftim · 2020-05-25T17:28:45Z

/remove-area blog

abhiTamrakar · 2020-05-25T17:42:57Z

@sftim doing now.

Apply suggestions from code review Co-Authored-By: Zach Corleissen <[email protected]> fix typo in kubelet client certificate name use both old and new CA for rotation include an alternative approach for CA rotation remove alternative approach Apply suggestions from code review Co-authored-by: Micah Hausler <[email protected]> reorder some tasks to avoid restart all pods again. reordered the CA rotation steps nit: fixing typo cause by an extra character. added reference to pod disruption budget

sftim · 2020-05-25T18:11:50Z

That looks squashed to me!

sftim · 2020-05-25T18:12:42Z

@kubernetes/sig-auth-pr-reviews please take a look

abhiTamrakar · 2020-06-05T17:11:16Z

@deads2k could you please review, @micahhausler requested a review from you as well.

neolit123 · 2020-06-10T18:49:43Z

@abhiTamrakar
seem there are some minor conflicts again.

k8s-ci-robot · 2020-06-10T18:49:51Z

@abhiTamrakar: PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

abhiTamrakar · 2020-06-11T02:02:50Z

@abhiTamrakar
seem there are some minor conflicts again.

What's the recommendation here? Last time I rebased there were 2k commits introduced.

neolit123 · 2020-06-11T02:14:50Z

you seem to be using your local master branch which is quite messy.
always create a new branch for new PRs.

i'm willing to take over this PR, rather than explaining standard git workflows.
co-authorship of your commit will be preserved.

would you agree to that?

neolit123 · 2020-06-11T02:25:12Z

new PR is here:
#21651

would you agree to that?

@abhiTamrakar
if you agree, please close this one.

abhiTamrakar · 2020-06-11T02:30:15Z

you seem to be using your local master branch which is quite messy.
always create a new branch for new PRs.

i'm willing to take over this PR, rather than explaining standard git workflows.
co-authorship of your commit will be preserved.

would you agree to that?

Yeah that's the basic mistake happened.

k8s-ci-robot added the cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. label Feb 27, 2020

k8s-ci-robot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Feb 27, 2020

k8s-ci-robot requested review from tengqm and zacharysarah February 27, 2020 18:42

k8s-ci-robot added language/en Issues or PRs related to English language sig/docs Categorizes an issue or PR as relevant to SIG Docs. labels Feb 27, 2020

abhiTamrakar changed the title ~~manual rotation of CA certificates #15444 and #19165~~ manual rotation of CA certificates #15444 and #19165 [WIP] Feb 27, 2020

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Feb 28, 2020

zacharysarah suggested changes Feb 28, 2020

View reviewed changes

neolit123 reviewed Feb 28, 2020

View reviewed changes

content/en/docs/tasks/tls/manual-rotation-of-ca-certificates.md Outdated Show resolved Hide resolved

k8s-ci-robot added the sig/auth Categorizes an issue or PR as relevant to SIG Auth. label Feb 28, 2020

abhiTamrakar requested review from zacharysarah and neolit123 February 29, 2020 10:32

k8s-ci-robot changed the title ~~manual rotation of CA certificates #15444 and #19165 [WIP]~~ [WIP] manual rotation of CA certificates (#15444 and #19165) Feb 29, 2020

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Feb 29, 2020

sftim reviewed Feb 29, 2020

View reviewed changes

content/en/docs/tasks/tls/manual-rotation-of-ca-certificates.md Outdated Show resolved Hide resolved

sftim reviewed Feb 29, 2020

View reviewed changes

content/en/docs/tasks/tls/manual-rotation-of-ca-certificates.md Outdated Show resolved Hide resolved

abhiTamrakar requested a review from sftim February 29, 2020 19:03

sftim reviewed Feb 29, 2020

View reviewed changes

content/en/docs/tasks/administer-cluster/kubeadm/kubeadm-certs.md Outdated Show resolved Hide resolved

sftim reviewed Feb 29, 2020

View reviewed changes

content/en/docs/tasks/tls/manual-rotation-of-ca-certificates.md Show resolved Hide resolved

k8s-ci-robot removed the area/blog Issues or PRs related to the Kubernetes Blog subproject label May 25, 2020

abhiTamrakar force-pushed the master branch from ef1b812 to de57586 Compare May 25, 2020 18:07

abhiTamrakar requested a review from sftim May 25, 2020 18:08

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 10, 2020

neolit123 mentioned this pull request Jun 11, 2020

tasks/tls: add a page for manual CA rotation #21651

Merged

abhiTamrakar closed this Jun 11, 2020

This was referenced Jun 11, 2020

Request to provide a clear documentation for CA rotation for those who want to do it #19165

Closed

Improvement for k8s.io/docs/tasks/tls/certificate-rotation/ #15444

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

manual rotation of CA certificates (#15444 and #19165) #19351

manual rotation of CA certificates (#15444 and #19165) #19351

abhiTamrakar commented Feb 27, 2020 •

edited

Loading

k8s-ci-robot commented Feb 27, 2020

k8s-ci-robot commented Feb 27, 2020

netlify bot commented Feb 27, 2020 •

edited

Loading

zacharysarah left a comment

jimangel commented Feb 28, 2020

neolit123 commented Feb 28, 2020

sftim commented Feb 29, 2020

sftim left a comment

abhiTamrakar commented Feb 29, 2020 •

edited

Loading

sftim commented Feb 29, 2020

abhiTamrakar commented May 25, 2020 •

edited

Loading

abhiTamrakar commented May 25, 2020

sftim commented May 25, 2020

sftim commented May 25, 2020

abhiTamrakar commented May 25, 2020

sftim commented May 25, 2020

sftim commented May 25, 2020

abhiTamrakar commented Jun 5, 2020

neolit123 commented Jun 10, 2020

k8s-ci-robot commented Jun 10, 2020

abhiTamrakar commented Jun 11, 2020

neolit123 commented Jun 11, 2020

neolit123 commented Jun 11, 2020

abhiTamrakar commented Jun 11, 2020

manual rotation of CA certificates (#15444 and #19165) #19351

manual rotation of CA certificates (#15444 and #19165) #19351

Conversation

abhiTamrakar commented Feb 27, 2020 • edited Loading

k8s-ci-robot commented Feb 27, 2020

k8s-ci-robot commented Feb 27, 2020

netlify bot commented Feb 27, 2020 • edited Loading

zacharysarah left a comment

Choose a reason for hiding this comment

jimangel commented Feb 28, 2020

neolit123 commented Feb 28, 2020

sftim commented Feb 29, 2020

sftim left a comment

Choose a reason for hiding this comment

abhiTamrakar commented Feb 29, 2020 • edited Loading

sftim commented Feb 29, 2020

abhiTamrakar commented May 25, 2020 • edited Loading

abhiTamrakar commented May 25, 2020

sftim commented May 25, 2020

sftim commented May 25, 2020

abhiTamrakar commented May 25, 2020

sftim commented May 25, 2020

sftim commented May 25, 2020

abhiTamrakar commented Jun 5, 2020

neolit123 commented Jun 10, 2020

k8s-ci-robot commented Jun 10, 2020

abhiTamrakar commented Jun 11, 2020

neolit123 commented Jun 11, 2020

neolit123 commented Jun 11, 2020

abhiTamrakar commented Jun 11, 2020

abhiTamrakar commented Feb 27, 2020 •

edited

Loading

netlify bot commented Feb 27, 2020 •

edited

Loading

abhiTamrakar commented Feb 29, 2020 •

edited

Loading

abhiTamrakar commented May 25, 2020 •

edited

Loading