CKS: control plane certificates are never renewed or checked, and the stored kubeconfig isn't refreshed after upgrade

未關閉
  • 哪裡不對？
#14,650 1 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

維護者通常 1 天內回覆

@bhouse-nexthop 已經在處理了。

開始於 2026年11月9日。

  • #14651 來自 @bhouse-nexthop —— 未關閉

評估

難度
5/5
預估耗時
一週以上
新手友好度
20/100
Issue 類型
缺陷
描述清晰度
描述清楚
活躍度
停滯
技術堆疊
java, kubernetes
領域
backend-api-design, infrastructure

研究方向

Start by tracing upgradeKubernetesCluster and getKubernetesClusterConfig, which the issue identifies as the upgrade and stored kubeconfig paths. Check how CKS reads and stores the control node’s kubeconfig, then inspect the related open pull request #14651 for work already underway. Done means refreshed kubeconfig data after certificate renewal and a decided approach for expiry checks and renewal.

由索引模型根據 Issue 內容生成。

描述

problem

CKS clusters are set up with kubeadm, which issues the control plane certificates (API server, front proxy, stacked etcd, and the client certificates in admin.conf, controller-manager.conf and scheduler.conf) for one year. The certificate authorities last ten years.

Nothing in CKS deals with that:

  1. No renewal. CKS never runs kubeadm certs renew, and there is no API to do it. kubeadm's own answer is "upgrade at least once a year", since kubeadm upgrade renews the certificates as a side effect. A cluster that isn't upgraded within a year stops working when the certificates expire: the API server rejects the controller manager, the scheduler and every admin client, and kubectl from CloudStack itself (/root/.kube/config on the control nodes) fails too.
  2. No expiry check. Nothing warns the operator before that happens. There's no alert and no event.
  3. The stored kubeconfig is not refreshed after an upgrade. getKubernetesClusterConfig returns the kubeConfigData cluster detail, which CKS only reads from the control node when the cluster starts. upgradeKubernetesCluster renews the certificates, admin.conf included, but the stored copy keeps the old admin certificate. Anyone who downloads the kubeconfig from CloudStack after an upgrade still gets a certificate that dies at the old expiry date. The same happens after renewing the certificates by hand.

Related: after an upgrade, /root/.kube/config on the control nodes, a copy of admin.conf that CKS uses for its own kubectl calls, also keeps the old certificate.

versions

main (and 4.22). The code involved hasn't changed in a long time, so earlier releases are affected too.

The steps to reproduce the bug
  1. Create a CKS cluster and leave it running.
  2. On a control node, run sudo /opt/bin/kubeadm certs check-expiration. Every leaf certificate expires one year after creation, and nothing in CloudStack reports it.
  3. Upgrade the cluster with upgradeKubernetesCluster. check-expiration now shows renewed certificates.
  4. Call getKubernetesClusterConfig and decode the client-certificate-data of the returned kubeconfig: its expiry is still the original one, a year after creation.
What to do about it?
  • Refresh the stored kubeconfig after an upgrade and after a renewal.
  • Check the certificate expiry periodically, and alert ahead of it (for example 60 and 30 days).
  • Add an API that renews the control plane certificates one control node at a time and restarts the control plane static pods.
  • Renew automatically, through the same path, some time before expiry (configurable).
主要語言
Java
星號
3.1k
分支
1.4k
平均合併
7 天 16 小時
30 天內合併 PR
15

環境準備

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

apache/cloudstack 的其他 Issue

查看 apache/cloudstack 的全部 Issue

相似的 Issue

更多 Java Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。