rke2 certificate check command not check the kube-controller-manager and kube-scheduler certificates in Rancher-provisioned RKE2 cluster
This document (000021676) is provided subject to the disclaimer at the end of this document.
Environment
Rancher 2.7.X
Rancher 2.8.X
Rancher 2.9.X
Rancher 2.10.X
Situation
In Rancher RKE2 provisioned cluster, there are two new certificates not managed by RKE2:
- /var/lib/rancher/rke2/server/tls/kube-scheduler/
- kube-scheduler.key
- kube-scheduler.crt
- /var/lib/rancher/rke2/server/tls/kube-controller-manager/
- kube-controller-manager.crt
- kube-controller-manager.key
These are new certificates whose creation is not managed by RKE2, but by custom kube-controller-manager and kube-scheduler args that Rancher automatically adds to the configuration. These args instruct the controller-manager and scheduler to create self-signed certs in specific locations managed by Rancher.
Resolution
The creation of these certs are added by Rancher, the certificates are managed by Rancher, and their rotation must done by initiating certificate rotation through Rancher UI.
- How to rotate the certificates for RKE2 custom clusters
Disclaimer
This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.
- Document ID:000021676
- Creation Date: 21-Jan-2025
- Modified Date:06-Feb-2025
-
- SUSE Rancher
For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]suse.com
