Repository metrics
- Stars
- (4,267 stars)
- PR merge metrics
- (PR metrics pending)
Description
User Story
As a [developer/user/operator] I would like to rotate a k8s cluster CA which involves many steps and restarts (rolling upgrade) of pods and updates on other resources (config maps, secrets, service accounts) which is manual: https://kubernetes.io/docs/tasks/tls/manual-rotation-of-ca-certificates/ With CAPI and the ability to deploy many target clusters from a management cluster, I am looking for available options to do the CA rotation at scale (manual operation on each cluster will be very costly). So, it would be interesting to know how the community is addressing this issue. Are there any external open-source tools that could be used to tackle this challenge?
Detailed Description There are also some cases in which the CA of the target clusters might be different from that of the management cluster.
Some use cases:
- Deploy of management cluster and many target clusters with the same CA. Perform the cluster CA rotation on the target clusters and the management clusters without impact on traffic
- Deploy of management cluster and many target clusters with different CA. Perform the cluster CA rotation on the target clusters and the management clusters without impact on traffic
[A clear and concise description of what you want to happen.] Possible ways to do CA rotation at scale with CAPI built-in support would be ideal
Anything else you would like to add: Checked the automatic cert rotation for control plane machines only introduced in https://github.com/kubernetes-sigs/cluster-api/pull/6983 which essentially tackles the part of the original issue on certificate management in https://github.com/kubernetes-sigs/cluster-api/issues/5490
[Miscellaneous information that will assist in solving the issue.]
/kind feature