[DO425] Caution: Kubelet client certificate expiring soon

[littlebigfab]

Hello,

Exploring section 6.6 of DO425 - Guided Exercise: Managing Certificates and Service Transport - I realized that the Kubelet client certificate of the lab environment is expiring in 3 months.

[root@node1 node]# openssl x509 -in certificates/kubelet-client-current.pem \
-text -noout
...output omitted...
    Validity
       Not Before: Oct 26 20:08:00 2018 GMT
       Not After : Oct 26 20:08:00 2019 GMT

Just to let you know.

[oldbenko]

Hey, @littlebigfab,

Thanks for pointing this out!

I am certain the course authors have that in mind, but just in case, I have created a ticket for them.

Cheers,
Grega

[Razique]

Thanks for letting us know. We have been watching our courses to make sure to renew the applications certificate as they come close to expiration. Thanks @oldbenko for the Jira.

[Vale_Uberti]

Hi certificates are expired and the cluster dosen't work.

[Vale_Uberti]

For using the lab you can apply this UGLY fix:

1) stop all the vms except the classroom

2) login as root in the classroom vm

3) stop the chronyd service

4) comment lines from 3 to 6 of /etc/chronyd.conf

5) timedatectl set-time "2019-07-07" (or something between 2018-10-26 2019-10-26)

6) restart chronyd and restart all the stopped vm.

[Razique]

Thanks for the tip @Vale_Uberti I will be working within the next few days on updating the classroom and will keep you posted.

[Razique · Accepted solution]

In the meanwhile, instead of modifying the time, please try the following:

1. Log in to the master node as the root user - which gives the system:admin privilege for the cluster.
2. Run the following command:

oc get csr | awk '/Pending/ {print; system("oc adm certificate approve "$1)}'

This command lists all certificates that are pending approval. Approving this first set of certificates will create another cert of two certificates in a pending state, one for each node.

Rerun the command one more time, this will trigger the renewal of the certificates.

[Vale_Uberti]

Thank you very much @Razique: it works

[Razique]

Happy to hear that @Vale_Uberti. Kudos to Ryan from the cert team to help me finding a temporary workaround while I work on releasing a new blueprint

[flozano]

Exercise for instructors and advanced students out there: rewrite Razique's pipeline using only '-o jsonpath' from oc get and a while loop from Bash. :-)

Then rewrite it again using the K8s module from Ansible. :-P