Add documentation for loopback certificates in kube-apiserver #49518
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
language/en
k8s-ci-robot
added
the
size/S
|
/cc @liggitt |
✅ Pull request preview available for checkingBuilt without sensitive environment variables
To edit notification comments on pull requests, go to your Netlify site configuration. |
| ### Loopback Certificate in kube-apiserver | ||
|
|
||
| The loopback certificate is used by the kube-apiserver to establish privileged loopback connections. | ||
| This certificate is stored in memory and has a validity period of one year. | ||
| However, it does not renew automatically. If the certificate expires, the kube-apiserver will cease to function. | ||
|
|
||
| The kube-apiserver is supported by the Kubernetes community for one year, | ||
| aligning with the validity of the loopback certificate. This means that to maintain community support, | ||
| you should upgrade the kube-apiserver within one year. The loopback certificate is automatically renewed during the kube-apiserver upgrade process. | ||
|
|
||
| {{< note >}} | ||
| Restarting the kube-apiserver is another way to renew the loopback certificate. | ||
| {{< /note >}} |
There was a problem hiding this comment.
I think this is the wrong place to describe this certificate; please move it within the Server certificates section earlier in the page.
to maintain community support, you should upgrade the kube-apiserver within one year
This is not factually correct; we sometimes provide slightly more than 1 year of formal support.
Recommending an API server restart at least once a year makes sense.
Description
The loopback certificate is an internal certificate that always exists within the kube-apiserver. Its expiration can cause the kube-apiserver to malfunction. However, there is currently no documentation detailing the risks associated with its expiration or how to troubleshoot related issues.
Issue
Closes: #46407