7 Commits (9f81cf096bfa56d22d345ff2f97473e03bc354d8)

Author	SHA1	Message	Date
Jacob Simpson	a926c1f258	Allow certificate manager to be initialized with no certs. ... Adds support to the certificate manager so it can be initialized with no certs and only a connection to the certificate request signing API. This specifically covers the scenario for the kubelet server certificate, where there is a request signing client but on first boot there is no bootstrapping or local certs.	2017-05-01 17:36:33 -07:00
Jacob Simpson	ac171f69f7	Restructure unit tests for more cert/keys.	2017-04-28 17:13:48 -07:00
Jacob Simpson	e992eaec8f	Add bootstrap support to certificate manager.	2017-04-20 16:27:32 -07:00
Kubernetes Submit Queue	4e3bbe3915	Merge pull request #42498 from jcbsmpsn/add-jitter-to-rotation-threshold ... Automatic merge from submit-queue (batch tested with PRs 44364, 44361, 42498) Fix the certificate rotation threshold and add jitter. Adjusts the certificate rotation threshold to be fixed, with some jitter to spread out the load on the Certificate Signing Request API. The rotation threshold is fixed at 20% now, meaning when 20% of the certificate's total duration is remaining, the certificate manager will attempt to rotate, with jitter +/-10%. For certificates of duration 1 month that means they will rotate after 24 days, +/- 3 days. On a 6000 node cluster, assuming all nodes added at nearly the same time, this should result in 6000 nodes rotating spread over 6 days (total range of the jitter), or ~42 nodes / hour requesting new certificates.	2017-04-14 17:56:01 -07:00
Mike Danese	a05c3c0efd	autogenerated	2017-04-14 10:40:57 -07:00
Jacob Simpson	e7666648bf	Fix the certificate rotation threshold and add jitter.	2017-04-11 09:20:16 -07:00
Jacob Simpson	855627e5cb	Rotate the kubelet certificate when about to expire. ... Changes the kubelet so it doesn't use the cert/key files directly for starting the TLS server. Instead the TLS server reads the cert/key from the new CertificateManager component, which is responsible for requesting new certificates from the Certificate Signing Request API on the API Server.	2017-02-17 17:42:35 -08:00