Skip to content

Commit c6ac783

Browse files
committed
manual-rotation-of-ca-certificates: use kube-controller-manager naming
1 parent 61e330d commit c6ac783

File tree

1 file changed

+3
-2
lines changed

1 file changed

+3
-2
lines changed

content/en/docs/tasks/tls/manual-rotation-of-ca-certificates.md

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,12 +33,13 @@ Configurations with a single API server will experience unavailability while the
3333
(ex: `ca.crt`, `ca.key`, `front-proxy-ca.crt`, and `front-proxy-ca.key`)
3434
to all your control plane nodes in the Kubernetes certificates directory.
3535

36-
1. Update *Kubernetes controller manager's* `--root-ca-file` to include both old and new CA and restart controller manager.
36+
1. Update {{< glossary_tooltip text="kube-controller-manager" term_id="kube-controller-manager" >}}'s `--root-ca-file` to
37+
include both old and new CA. Then restart the component.
3738

3839
Any service account created after this point will get secrets that include both old and new CAs.
3940

4041
{{< note >}}
41-
The files specified by the *Kubernetes controller manager* flags `--client-ca-file` and `--cluster-signing-cert-file`
42+
The files specified by the kube-controller-manager flags `--client-ca-file` and `--cluster-signing-cert-file`
4243
cannot be CA bundles. If these flags and `--root-ca-file` point to the same `ca.crt` file which is now a
4344
bundle (includes both old and new CA) you will face an error. To workaround this problem you can copy the new CA to a separate
4445
file and make the flags `--client-ca-file` and `--cluster-signing-cert-file` point to the copy. Once `ca.crt` is no longer

0 commit comments

Comments
 (0)