Skip to content

Commit ff0b27b

Browse files
ShaunaDiazShaunaDiaz
authored
Merge pull request #101677 from ShaunaDiaz/OSDOCS-15648
OSDOCS-15648: mods and updates responsive restarts MicroShift
2 parents 53324f0 + e0b16e5 commit ff0b27b

8 files changed

+107
-67
lines changed

‎_topic_maps/_topic_map_ms.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -298,7 +298,7 @@ Topics:
298298
- Name: Troubleshoot etcd
299299
File: microshift-etcd-troubleshoot
300300
- Name: Additional information
301-
File: microshift-things-to-know
301+
File: microshift-responsive-restarts-cas
302302
- Name: Data cleanup
303303
File: microshift-cleanup-data
304304
---

‎microshift_troubleshooting/microshift-responsive-restarts-cas.adoc‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
:_mod-docs-content-type: ASSEMBLY
2+
[id="microshift-responsive-restarts-cas"]
3+
= Responsive restarts and security certificates
4+
5+
include::_attributes/attributes-microshift.adoc[]
6+
:context: microshift-responsive-restarts-cas
7+
8+
toc::[]
9+
10+
[role="_abstract"]
11+
{microshift-short} responds to system configuration changes and restarts after alterations are detected, including IP address changes, clock adjustments, and security certificate age.
12+
13+
include::modules/microshift-ip-address-clock-changes.adoc[leveloffset=+1]
14+
15+
include::modules/microshift-certificate-lifetime.adoc[leveloffset=+1]
16+
17+
include::modules/microshift-certificate-rotation.adoc[leveloffset=+1]
18+
19+
include::modules/microshift-short-term-certificate-rotation.adoc[leveloffset=+2]
20+
21+
include::modules/microshift-long-term-certificate-rotation.adoc[leveloffset=+2]
22+
23+
[id="additional-resources_microshift-responsive-restarts-cas"]
24+
[role="_additional-resources"]
25+
== Additional resources
26+
27+
* xref:../microshift_configuring/microshift_auth_security/microshift-custom-ca.adoc#microshift-custom-ca[Configuring custom certificate authorities]

‎microshift_troubleshooting/microshift-things-to-know.adoc‎

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎modules/microshift-certificate-lifetime.adoc‎

Lines changed: 6 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -1,51 +1,15 @@
11
// Module included in the following assemblies:
22
//
3-
// * microshift/microshift-things-to-know.adoc
3+
// * microshift_troubleshooting/microshift-responsive-restarts-cas.adoc
44

55
:_mod-docs-content-type: CONCEPT
66
[id="microshift-certificate-lifetime_{context}"]
77
= Security certificate lifetime
88

9-
{microshift-short} certificates are separated into two basic groups:
9+
[role="_abstract"]
10+
{microshift-short} certificates are digital certificates that secure communication with communication protocols such as HTTPS. They fall into two basic categories:
1011

11-
. Short-lived certificates having certificate validity of one year.
12-
. Long-lived certificates having certificate validity of 10 years.
12+
Short-lived certificates:: Have a certificate validity of one year. Most server or leaf certificates are short-lived.
13+
Long-lived certificates:: Have a certificate validity of 10 years. An example of a long-lived certificate is the client certificate for `system:admin user` authentication, or the certificate of the signer of the `kube-apiserver` external serving certificate.
1314

14-
Most server or leaf certificates are short-lived.
15-
16-
An example of a long-lived certificate is the client certificate for `system:admin user` authentication, or the certificate of the signer of the `kube-apiserver` external serving certificate.
17-
18-
[id="microshift-certificate-rotation_{context}"]
19-
== Certificate rotation
20-
Certificates that are expired or close to their expiration dates need to be rotated to ensure continued {microshift-short} operation. When {microshift-short} restarts for any reason, certificates that are close to expiring are rotated. A certificate that is set to expire imminently, or has expired, can cause an automatic {microshift-short} restart to perform a rotation.
21-
22-
[IMPORTANT]
23-
====
24-
If the rotated certificate is a {microshift-short} certificate authority (CA), then all of the signed certificates rotate. If you created any custom CAs, ensure the CAs manually rotate.
25-
====
26-
27-
[id="microshift-st-certificate-rotation_{context}"]
28-
=== Short-term certificates
29-
The following situations describe {microshift-short} actions during short-term certificate lifetimes:
30-
31-
. No rotation:
32-
.. When a short-term certificate is up to 5 months old, no rotation occurs.
33-
34-
. Rotation at restart:
35-
.. When a short-term certificate is 5 to 8 months old, it is rotated when {microshift-short} starts or restarts.
36-
37-
. Automatic restart for rotation:
38-
.. When a short-term certificate is more than 8 months old, {microshift-short} can automatically restart to rotate and apply a new certificate.
39-
40-
[id="microshift-lt-certificate-rotation_{context}"]
41-
=== Long-term certificates
42-
The following situations describe {microshift-short} actions during long-term certificate lifetimes:
43-
44-
. No rotation:
45-
.. When a long-term certificate is up to 8.5 years old, no rotation occurs.
46-
47-
. Rotation at restart:
48-
.. When a long-term certificate is 8.5 to 9 years old, it is rotated when {microshift-short} starts or restarts.
49-
50-
. Automatic restart for rotation:
51-
.. When a long-term certificate is more than 9 years old, {microshift-short} might automatically restart so that it can rotate and apply a new certificate.
15+
{microshift-short} restarts automatically in certain cases, depending on certificate age.

‎modules/microshift-certificate-rotation.adoc‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_troubleshooting/microshift-responsive-restarts-cas.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="microshift-certificate-rotation_{context}"]
7+
= Certificate rotation
8+
9+
[role="_abstract"]
10+
Certificates that are expired or close to their expiration dates must be rotated to ensure continued {microshift-short} operation. This rotation can be an automatic process.
11+
12+
When {microshift-short} restarts for any reason, certificates that are close to expiring are rotated. A certificate that expires soon, or has already expired, can also cause an automatic {microshift-short} restart to perform a rotation.
13+
14+
[IMPORTANT]
15+
====
16+
If the rotated certificate is a {microshift-short} certificate authority (CA), then all of the signed certificates rotate. If you created any custom CAs, ensure that the CAs manually rotate.
17+
====

‎modules/microshift-ip-address-clock-changes.adoc‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_troubleshooting/microshift-responsive-restarts-cas.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="microshift-ip-address-clock-changes_{context}"]
7+
= IP address changes or clock adjustments
8+
9+
[role="_abstract"]
10+
{microshift-short} depends on device IP addresses and system-wide clock settings to remain consistent during its runtime. However, these settings might occasionally change on edge devices.
11+
12+
For example, DHCP or Network Time Protocol (NTP) updates can change times. When these changes occur, some {microshift-short} components might stop functioning properly. To mitigate this situation, {microshift-short} monitors the IP address and system time and restarts if either setting changes.
13+
14+
The threshold for clock changes is a time change of greater than 10 seconds in either direction. Smaller drifts on regular time adjustments performed by the Network Time Protocol (NTP) service do not cause a restart.

‎modules/microshift-long-term-certificate-rotation.adoc‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_troubleshooting/microshift-responsive-restarts-cas.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="microshift-long-term-certificate-rotation_{context}"]
7+
= Long-term certificates rotation
8+
9+
[role="_abstract"]
10+
Long-term certificates that are expired or close to their expiration dates must be rotated to ensure continued {microshift-short} operation.
11+
12+
The following situations describe {microshift-short} actions during long-term certificate lifetimes:
13+
14+
No rotation::
15+
When a long-term certificate is up to 8.5 years old, no rotation occurs.
16+
17+
Rotation at restart::
18+
When a long-term certificate is 8.5 to 9 years old, it is rotated when {microshift-short} starts or restarts.
19+
20+
Automatic restart for rotation::
21+
When a long-term certificate is more than 9 years old, {microshift-short} might automatically restart so that it can rotate and apply a new certificate.

‎modules/microshift-short-term-certificate-rotation.adoc‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * microshift_troubleshooting/microshift-responsive-restarts-cas.adoc
4+
5+
:_mod-docs-content-type: CONCEPT
6+
[id="microshift-short-term-certificate-rotation_{context}"]
7+
= Short-term certificates rotation
8+
9+
[role="_abstract"]
10+
Short-term certificates that are expired or close to their expiration dates must be rotated to ensure continued {microshift-short} operation.
11+
12+
The following situations describe {microshift-short} actions during short-term certificate lifetimes:
13+
14+
No rotation::
15+
When a short-term certificate is up to 5 months old, no rotation occurs.
16+
17+
Rotation at restart::
18+
When a short-term certificate is 5 to 8 months old, it is rotated when {microshift-short} starts or restarts.
19+
20+
Automatic restart for rotation::
21+
When a short-term certificate is more than 8 months old, {microshift-short} can automatically restart to rotate and apply a new certificate.

0 commit comments

Comments
 (0)