From 30cd91dc6bc3d578fa10728beff372b71a99dac4 Mon Sep 17 00:00:00 2001
From: Hari Hud <51223100+harihud@users.noreply.github.com>
Date: Fri, 17 Sep 2021 17:01:00 +0530
Subject: [PATCH] Add option to kubeadm upgrade command to control certificates
renewal during control plane upgrade (#7976)
* Add option to kubeadm upgrade command to control certificates renewal during control plane upgrade
* Remove training whitespace
---
roles/kubernetes/control-plane/defaults/main/main.yml | 4 ++++
roles/kubernetes/control-plane/tasks/kubeadm-upgrade.yml | 2 ++
2 files changed, 6 insertions(+)
diff --git a/roles/kubernetes/control-plane/defaults/main/main.yml b/roles/kubernetes/control-plane/defaults/main/main.yml
index f83133cbe..dbd2961f0 100644
--- a/roles/kubernetes/control-plane/defaults/main/main.yml
+++ b/roles/kubernetes/control-plane/defaults/main/main.yml
@@ -193,3 +193,7 @@ event_ttl_duration: "1h0m0s"
auto_renew_certificates: false
# First Monday of each month
auto_renew_certificates_systemd_calendar: "Mon *-*-1,2,3,4,5,6,7 03:{{ groups['kube_control_plane'].index(inventory_hostname) }}0:00"
+# kubeadm renews all the certificates during control plane upgrade.
+# If we have requirement like without renewing certs upgrade the cluster,
+# we can opt out from the default behavior by setting kubeadm_upgrade_auto_cert_renewal to false
+kubeadm_upgrade_auto_cert_renewal: true
diff --git a/roles/kubernetes/control-plane/tasks/kubeadm-upgrade.yml b/roles/kubernetes/control-plane/tasks/kubeadm-upgrade.yml
index 0570ee9d0..a809f0ee1 100644
--- a/roles/kubernetes/control-plane/tasks/kubeadm-upgrade.yml
+++ b/roles/kubernetes/control-plane/tasks/kubeadm-upgrade.yml
@@ -14,6 +14,7 @@
timeout -k 600s 600s
{{ bin_dir }}/kubeadm
upgrade apply -y {{ kube_version }}
+ --certificate-renewal={{ kubeadm_upgrade_auto_cert_renewal }}
--config={{ kube_config_dir }}/kubeadm-config.yaml
--ignore-preflight-errors=all
--allow-experimental-upgrades
@@ -34,6 +35,7 @@
timeout -k 600s 600s
{{ bin_dir }}/kubeadm
upgrade apply -y {{ kube_version }}
+ --certificate-renewal={{ kubeadm_upgrade_auto_cert_renewal }}
--config={{ kube_config_dir }}/kubeadm-config.yaml
--ignore-preflight-errors=all
--allow-experimental-upgrades
--
GitLab