Skip to content

Rotate the cluster certificate authorities New#

MKE 4 delegates the Kubernetes control plane PKI to k0s. You can rotate the following k0s-owned certificate authorities (CAs):

CA                                               Files                   Signs
Kubernetes CA pki/ca.{crt,key} API server serving certificate, admin, scheduler, controller manager, kubelet client and server, konnectivity
ServiceAccount key pair pki/sa.{key,pub} All ServiceAccount tokens in the cluster
etcd CA pki/etcd/ca.{crt,key} etcd server, etcd peer, apiserver-etcd-client
front-proxy CA pki/front-proxy-ca.{crt,key} front-proxy-client (aggregation layer)

Note

The mkectl certs status, mkectl certs dump, and mkectl certs rotate commands require MKE 4.2.1 or later.

Warning

CA rotation requires full cluster downtime. k0s does not provide automated rotation without downtime, a rotation mechanism, or a a dual-trust window. As such:

  • The cluster API is unavailable for the duration of the procedure.
  • Rotating the Kubernetes CA or the ServiceAccount key pair requires that you rejoin every worker node.
  • The only rollback method is to restore the cluster from backup.

In addition, MKE 4 does not provide a successor to the MKE 3 ca --cluster --rotate and ca --etcd --rotate commands, though the rotation instruction herein replaces them. For more information, refer to CA rotation for MKE 3 users.

To rotate the cluster CAs, complete the following topics in order:

  1. CA rotation impact
  2. Prepare for CA rotation
  3. Perform the CA rotation
  4. Verify the CA rotation

If the rotation fails, refer to Recover from a failed CA rotation.

Rotations not covered by this procedure#

The following rotations do not require this procedure:

Task                                                 Method
Revoke user access Revoke access at the identity provider. MKE 4 does not issue client certificates to users, and thus CA rotation does not remove the ability of a user to authenticate.
Rotate the MKE Client Root CA Run the mkectl certs rotate --client-ca command. The rotation occurs in place with no downtime. You can safely interrupt the command and resume it by running it again.
Replace an expiring ingress or API serving certificate Run the mkectl certs status command to confirm which certificates are expiring. For more information, refer to TLS certificates.

Note

The mkectl certs rotate command rotates only those CAs that it can replace without downtime, and it never includes a CA that requires downtime unless you name that CA explicitly. The k0s-owned CAs have no in-place rotation mechanism, and thus the mkectl certs rotate command cannot rotate them.