External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-10-30 06:13:29 -02:30
Code Issues Packages Projects Releases Wiki Activity

Fix k8s-certs-renew renewing on nodes without super-admin.conf (#13414)

Browse Source 
Signed-off-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
This commit is contained in:
Ali Afsharzadeh
2026-09-03 14:30:21 +00:00
committed by GitHub
parent afd33dd657
commit e125a30b16
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
roles/kubernetes/control-plane/templates/k8s-certs-renew.sh.j2
+6 -1
View File
@@ -15,11 +15,16 @@ else
current_time=$(date +%s)
target_time=$(date -d "${next_time} + ${days_buffer} days" +%s) # $next_time - $days_buffer days
expiry_threshold=$(( ${target_time} - ${current_time} ))
expired_certs=$({{ bin_dir }}/kubeadm certs check-expiration -o jsonpath="{.certificates[?(@.residualTime<${expiry_threshold}.0)]}")
# super-admin.conf only exists on the node where "kubeadm init" ran, the other
# control plane nodes see it as missing (residualTime 0). Don't let missing
# certs force a renewal here, kubeadm can't renew them anyway.
expired_certs=$({{ bin_dir }}/kubeadm certs check-expiration -o jsonpath="{range .certificates[?(@.residualTime<${expiry_threshold}.0)]}{.name}={.missing}{\"\n\"}{end}" | sed -n 's/=false$//p')
if [ "${expired_certs}" == "" ];then
echo "## Skip cert renew and K8S container restart, since all residualTimes are beyond threshold ##"
exit 0
fi
echo "## Certificates to renew: ##"
echo "${expired_certs}"
fi
echo "## Renewing certificates managed by kubeadm ##"