ORBOS and K8S certificates

[privateVoit]

Hi there!

I've got a question regarding the certificates. To what extent is ORBOS involved in managing K8S certificates for the api-server and etcd?

Specifically:

• Does ORBOS interact with the K8S certificates?
• Does ORBOS manage the renewal of the certificates?
• Does ORBOS configure a different lifespan for the certificates? (We have seen a lifespan of 6 months instead of the usual 12)

Informations about our clusters
Kubernetes Version: v1.18.0 & v1.17.2
ORBOS Version: v2.1.0
Provider: Static Provider with CentOS 7

Thank you in advance!

[fforootd]

Hi There

Welcome to our community and thank you for using ORBOS as your platform driver.
These are great questions and you can find our answers below, hope this helps.

Does ORBOS interact with the K8S certificates?

ORBOS does only interact with the K8s certificates through native kubeadm processes.
See the next question for a more detailed answer to this.

Does ORBOS manage the renewal of the certificates?

Somewhat indirect it does. As we rely on kubeadm, the certificates are rotated whenever you upgrade your K8s Version.

See the outlined process of kubeadm here

Does ORBOS configure a different lifespan for the certificates? (We have seen a lifespan of 6 months instead of the usual 12)

No, ORBOS uses the default of 12 months for the certificates.

If further questions arise, feel free to engage with us.

[privateVoit]

Thank you for your answer! I really appreciate it.

I've got one follow up question. Does Orbiter update it's kubeconfig when the config is renewed?

Thank you!

[eliobischof]

ORBITER does not yet update the kubeconfig property in orbiter.yml after updating Kubernetes. I've opened an issue for this #596

In the meanwhile, you should be able to copy the new kubeconfig from the first controlplane node and use the orbctl writesecret command to write it to the orbiter.yml yourself

[privateVoit]

Thank you!

That's all we needed to know!