https://rancher.com/ logo
Join Slack
Powered by
This message was deleted.
# rke2
a
This message was deleted.
g
This is config yaml for my agent node
Copy code
[root@rke2agent1 bilge]# cat /etc/rancher/rke2/config.yaml
server: <https://rancher.exemple.com:9345>
system-default-registry: 10.0.0.10:5000
token: fuzzybunnyslippers
write-kubeconfig-mode: "0600"
node-ip: "10.0.0.5"
kube-apiserver-arg:
- authorization-mode=RBAC,Node
kubelet-arg:
- protect-kernel-defaults=true
- read-only-port=0
- authorization-mode=Webhook
kubelet-arg:
- protect-kernel-defaults=true
- read-only-port=0
- authorization-mode=Webhook
- minimum-container-ttl-duration=10s
- maximum-dead-containers-per-container=2
- maximum-dead-containers=240
- image-gc-high-threshold=85
- image-gc-low-threshold=80
h
https://docs.rke2.io/security/certificates?_highlight=certificate#rotating-ca-certificates > Any certificates that are expired, or within 90 days of expiring, are automatically renewed every time RKE2 starts. This tells me it will only renew certificates if they are within 90-days of expiring (or already expired)
g
Can you check this https://docs.rke2.io/advanced, To renew agent certificates, restart rke2-agent in agent nodes. Agent certificates are renewed every time the agent starts.
I delete the certificate "rm -rf /var/lib/rancher/rke2/agent/client-rke2-controller.crt " and restart rke2-agent. Hovewer, certificate date is the same.
Copy code
[root@rke2agent1 agent]# rke2 certificate check
INFO[0000] Agent detected, checking agent certificates
INFO[0000] Checking certificates for rke2-controller
INFO[0000] /var/lib/rancher/rke2/agent/client-rke2-controller.crt: certificate CN=system:rke2-controller is ok, expires at 2025-05-17T13:00:35Z
INFO[0000] /var/lib/rancher/rke2/agent/client-rke2-controller.crt: certificate CN=rke2-client-ca@1715943396 is ok, expires at 2034-05-15T10:56:36Z
INFO[0000] Checking certificates for kube-proxy
INFO[0000] /var/lib/rancher/rke2/agent/client-kube-proxy.crt: certificate CN=system:kube-proxy is ok, expires at 2025-05-17T13:00:35Z
INFO[0000] /var/lib/rancher/rke2/agent/client-kube-proxy.crt: certificate CN=rke2-client-ca@1715943396 is ok, expires at 2034-05-15T10:56:36Z
INFO[0000] Checking certificates for kubelet
INFO[0000] /var/lib/rancher/rke2/agent/client-kubelet.crt: certificate CN=system:node:rke2agent1,O=system:nodes is ok, expires at 2025-07-10T12:47:10Z
INFO[0000] /var/lib/rancher/rke2/agent/client-kubelet.crt: certificate CN=rke2-client-ca@1715943396 is ok, expires at 2034-05-15T10:56:36Z
INFO[0000] /var/lib/rancher/rke2/agent/serving-kubelet.crt: certificate CN=rke2agent1 is ok, expires at 2025-07-10T12:47:10Z
INFO[0000] /var/lib/rancher/rke2/agent/serving-kubelet.crt: certificate CN=rke2-server-ca@1715943396 is ok, expires at 2034-05-15T10:56:36Z
I stopped rke-2 agent and used rke2 certificate rotate command and it dosent work either.
Copy code
[root@rke2agent1 agent]# rke2 certificate rotate
INFO[0000] Agent detected, rotating agent certificates
INFO[0000] Rotating certificates for kube-proxy
INFO[0000] Rotating certificates for kubelet
INFO[0000] Rotating certificates for rke2-controller
INFO[0000] Successfully backed up certificates to /var/lib/rancher/rke2/agent/tls-1720617032, please restart rke2 server or agent to rotate certificates
[root@rke2agent1 agent]# systemctl start rke2-agent
[root@rke2agent1 agent]# rke2 certificate check
INFO[0000] Agent detected, checking agent certificates
INFO[0000] Checking certificates for kubelet
INFO[0000] /var/lib/rancher/rke2/agent/client-kubelet.crt: certificate CN=system:node:rke2agent1,O=system:nodes is ok, expires at 2025-07-10T13:10:41Z
INFO[0000] /var/lib/rancher/rke2/agent/client-kubelet.crt: certificate CN=rke2-client-ca@1715943396 is ok, expires at 2034-05-15T10:56:36Z
INFO[0000] /var/lib/rancher/rke2/agent/serving-kubelet.crt: certificate CN=rke2agent1 is ok, expires at 2025-07-10T13:10:40Z
INFO[0000] /var/lib/rancher/rke2/agent/serving-kubelet.crt: certificate CN=rke2-server-ca@1715943396 is ok, expires at 2034-05-15T10:56:36Z
INFO[0000] Checking certificates for rke2-controller
INFO[0000] /var/lib/rancher/rke2/agent/client-rke2-controller.crt: certificate CN=system:rke2-controller is ok, expires at 2025-05-17T12:13:19Z
INFO[0000] /var/lib/rancher/rke2/agent/client-rke2-controller.crt: certificate CN=rke2-client-ca@1715943396 is ok, expires at 2034-05-15T10:56:36Z
INFO[0000] Checking certificates for kube-proxy
INFO[0000] /var/lib/rancher/rke2/agent/client-kube-proxy.crt: certificate CN=system:kube-proxy is ok, expires at 2025-05-17T12:13:19Z
INFO[0000] /var/lib/rancher/rke2/agent/client-kube-proxy.crt: certificate CN=rke2-client-ca@1715943396 is ok, expires at 2034-05-15T10:56:36Z
h
Try with 
rke2-killall.sh
instead of 
systemctl stop rke2-agent
g
It dosent work, I can rotate server certificates but I cant rotate agent certificates.
h
I think there maybe something missing in docs...
Copy code
client-rke2-controller.crt: certificate CN=system:rke2-controller is ok, expires at 2025-05-17T12:13:19Z
client-kube-proxy.crt: certificate CN=system:kube-proxy is ok, expires at 2025-05-17T12:13:19Z
These certs expire in May 2025 so they have several months left... I know docs say they will renew every time agent starts but clearly it does not so maybe it only renews within 90-days - also for agents? I am not sure....
g
For server, All certificates are rotated incluede client-kube-proxy.crt and client-rke2-controller.crt
c
rotate the server certs first. then restart the agent. The agent uses the certs generated by the server. If you don’t follow the documented steps, and try to rotate the agent first, or only the agent, then all of the certs will not be rotated.
✅ 1
g
Than you very much
49 Views
Open in Slack
PreviousNext
Powered by