Skip to content

docs: use Kubernetes Certificates Rotator product name #840

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chinameok merged 1 commit into from
Aug 28, 2026
+8 −8
Merged

docs: use Kubernetes Certificates Rotator product name #840

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions ...n/solutions/Recovering_ACP_Kubernetes_certificates_with_cluster_cert_rotator.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,17 +7,17 @@ ProductsVersion:
- '4.x'
---

# Recovering ACP Kubernetes Certificates with cluster-cert-rotator
# Recovering ACP Kubernetes Certificates with Kubernetes Certificates Rotator

## Issue

After `cluster-cert-rotator` issues short-lived certificates, uninstalling the plugin does not restore the previous long-lived certificates. Certificates already written to a node remain unchanged, and automatic renewal stops when the plugin is removed.
After Kubernetes Certificates Rotator issues short-lived certificates, uninstalling the plugin does not restore the previous long-lived certificates. Certificates already written to a node remain unchanged, and automatic renewal stops when the plugin is removed.

This procedure is for an approved emergency recovery. It re-signs existing certificates with the cluster's current CA certificates and private keys. It is not a standard maintenance operation and does not extend the CA itself.

## Environment

This procedure applies to an ACP cluster that uses kubeadm-style files under `/etc/kubernetes` and has the `cert-renew` tool files delivered by `cluster-cert-rotator`. The plugin namespace is normally `cpaas-system`; confirm the installed release and image tag before using a tool from a different release.
This procedure applies to an ACP cluster that uses kubeadm-style files under `/etc/kubernetes` and has the `cert-renew` tool files delivered by Kubernetes Certificates Rotator. The plugin namespace is normally `cpaas-system`; confirm the installed release and image tag before using a tool from a different release.

Run the recovery separately on every node in the cluster, including all control-plane and worker nodes. The script changes only the local files on the node where it runs; running it on one node does not update any other node. Worker nodes normally do not have the CA private key. Because the script requires a CA private key, the approved recovery plan must define how to provide, protect, and remove the key on each worker node.

Expand Down Expand Up @@ -180,7 +180,7 @@ Check the kubelet and control-plane logs for restart failures. Confirm etcd endp

## Root Cause

`cluster-cert-rotator` changes the requested duration through its controller configuration, but removing the plugin does not rewrite certificates that it already issued. The standalone `cert-renew` utility signs replacement certificates with the existing CA and sets `NotAfter` to `now + days`; it does not inspect or clamp that value to the CA expiry. The effective lifetime is bounded by whichever comes first: the requested duration or the CA expiry.
Kubernetes Certificates Rotator changes the requested duration through its controller configuration, but removing the plugin does not rewrite certificates that it already issued. The standalone `cert-renew` utility signs replacement certificates with the existing CA and sets `NotAfter` to `now + days`; it does not inspect or clamp that value to the CA expiry. The effective lifetime is bounded by whichever comes first: the requested duration or the CA expiry.

## Rollback

Expand Down
8 changes: 4 additions & 4 deletions ...h/solutions/Recovering_ACP_Kubernetes_certificates_with_cluster_cert_rotator.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,17 +7,17 @@ ProductsVersion:
- '4.x'
---

# 使用 cluster-cert-rotator 恢复 ACP Kubernetes 证书
# 使用 Kubernetes Certificates Rotator 恢复 ACP Kubernetes 证书

## 问题

`cluster-cert-rotator` 已经签发短有效期证书后，卸载插件不会自动恢复之前的长有效期证书。节点上已经写入的证书保持不变，插件移除后也不会再发生自动续期。
Kubernetes Certificates Rotator 已经签发短有效期证书后，卸载插件不会自动恢复之前的长有效期证书。节点上已经写入的证书保持不变，插件移除后也不会再发生自动续期。

本文步骤只用于经过批准的紧急恢复。它使用集群当前的 CA 证书和私钥重新签发现有证书，不是日常维护操作，也不会延长 CA 自身的有效期。

## 环境

本文适用于使用 kubeadm 风格 `/etc/kubernetes` 文件布局，并且已经由 `cluster-cert-rotator` 交付 `cert-renew` 工具文件的 ACP 集群。插件命名空间通常是 `cpaas-system`；执行前先确认已安装插件的版本和镜像标签，不要直接使用其他版本的工具。
本文适用于使用 kubeadm 风格 `/etc/kubernetes` 文件布局，并且已经由 Kubernetes Certificates Rotator 交付 `cert-renew` 工具文件的 ACP 集群。插件命名空间通常是 `cpaas-system`；执行前先确认已安装插件的版本和镜像标签，不要直接使用其他版本的工具。

恢复操作必须在集群中的每个节点上分别执行，包括所有控制平面节点和工作节点。该脚本只修改当前节点的本地文件，在一台节点上执行不会更新其他节点。工作节点通常没有 CA 私钥；由于脚本需要 CA 私钥才能运行，获批的恢复方案必须明确规定如何临时提供、保护并清理工作节点上的 CA 私钥。

Expand Down Expand Up @@ -180,7 +180,7 @@ kubectl get pods -n kube-system -o wide

## 根本原因

`cluster-cert-rotator` 通过控制器配置改变签发有效期，但卸载插件不会改写它已经签发的证书。独立的 `cert-renew` 工具使用现有 CA 重新签发证书，并将 `NotAfter` 设置为 `now + days`；它不会检查或截断为 CA 到期时间。因此实际有效期同时受请求天数和 CA 剩余有效期约束，不能只看请求参数。
Kubernetes Certificates Rotator 通过控制器配置改变签发有效期，但卸载插件不会改写它已经签发的证书。独立的 `cert-renew` 工具使用现有 CA 重新签发证书，并将 `NotAfter` 设置为 `now + days`；它不会检查或截断为 CA 到期时间。因此实际有效期同时受请求天数和 CA 剩余有效期约束，不能只看请求参数。

## 回滚

Expand Down
Loading