Recovering from expired control plane certificates

来源 1 浏览 156 扫码打印 2021-10-21 08:00:40

Recovering from expired control plane certificates

However, you must manually approve the pending certificate signing requests (CSRs) to recover kubelet certificates. For user-provisioned installations, you might also need to approve pending kubelet serving CSRs.

Use the following steps to approve the pending CSRs:

For user-provisioned installations, approve each valid kubelet serving CSR:

About
- Welcome
API reference
- Understanding API tiers
- API compatibility guidelines
- Editing kubelet log level verbosity and gathering logs
- API list
- Authorization APIs
  - LocalSubjectAccessReview [authorization.k8s.io/v1]
  - SubjectAccessReview [authorization.k8s.io/v1]
  - SelfSubjectRulesReview [authorization.k8s.io/v1]
  - About Authorization APIs
  - LocalSubjectAccessReview [authorization.openshift.io/v1]
  - SubjectRulesReview [authorization.openshift.io/v1]
  - TokenReview [authentication.k8s.io/v1]
  - ResourceAccessReview [authorization.openshift.io/v1]
  - LocalResourceAccessReview [authorization.openshift.io/v1]
  - SelfSubjectRulesReview [authorization.openshift.io/v1]
  - SubjectAccessReview [authorization.openshift.io/v1]
  - SelfSubjectAccessReview [authorization.k8s.io/v1]
- Autoscale APIs
  - ClusterAutoscaler [autoscaling.openshift.io/v1]
  - MachineAutoscaler [autoscaling.openshift.io/v1beta1]
  - HorizontalPodAutoscaler [autoscaling/v1]
  - About Autoscale APIs
- Common object reference
  - Index
- Config APIs
  - Console [config.openshift.io/v1]
  - ClusterVersion [config.openshift.io/v1]
  - OperatorHub [config.openshift.io/v1]
  - About Config APIs
  - Ingress [config.openshift.io/v1]
  - Network [config.openshift.io/v1]
  - HelmChartRepository [helm.openshift.io/v1beta1]
  - Scheduler [config.openshift.io/v1]
  - APIServer [config.openshift.io/v1]
  - DNS [config.openshift.io/v1]
  - OAuth [config.openshift.io/v1]
  - Authentication [config.openshift.io/v1]
  - Project [config.openshift.io/v1]
  - Image [config.openshift.io/v1]
  - FeatureGate [config.openshift.io/v1]
  - Infrastructure [config.openshift.io/v1]
  - ClusterOperator [config.openshift.io/v1]
  - Proxy [config.openshift.io/v1]
  - Build [config.openshift.io/v1]
- Console APIs
  - About Console APIs
  - ConsoleQuickStart [console.openshift.io/v1]
  - ConsoleYAMLSample [console.openshift.io/v1]
  - ConsolePlugin [console.openshift.io/v1alpha1]
  - ConsoleCLIDownload [console.openshift.io/v1]
  - ConsoleNotification [console.openshift.io/v1]
  - ConsoleLink [console.openshift.io/v1]
  - ConsoleExternalLogLink [console.openshift.io/v1]
- Extension APIs
  - About Extension APIs
  - APIService [apiregistration.k8s.io/v1]
  - MutatingWebhookConfiguration [admissionregistration.k8s.io/v1]
  - CustomResourceDefinition [apiextensions.k8s.io/v1]
  - ValidatingWebhookConfiguration [admissionregistration.k8s.io/v1]
- Image APIs
  - ImageSignature [image.openshift.io/v1]
  - About Image APIs
  - ImageTag [image.openshift.io/v1]
  - ImageStreamMapping [image.openshift.io/v1]
  - ImageStreamTag [image.openshift.io/v1]
  - ImageStreamImport [image.openshift.io/v1]
  - Image [image.openshift.io/v1]
  - ImageStream [image.openshift.io/v1]
  - ImageStreamImage [image.openshift.io/v1]
- Machine APIs
  - ContainerRuntimeConfig [machineconfiguration.openshift.io/v1]
  - MachineSet [machine.openshift.io/v1beta1]
  - ControllerConfig [machineconfiguration.openshift.io/v1]
  - Machine [machine.openshift.io/v1beta1]
  - MachineConfigPool [machineconfiguration.openshift.io/v1]
  - KubeletConfig [machineconfiguration.openshift.io/v1]
  - MachineHealthCheck [machine.openshift.io/v1beta1]
  - About Machine APIs
  - MachineConfig [machineconfiguration.openshift.io/v1]
- Metadata APIs
  - Event [core/v1]
  - Event [events.k8s.io/v1]
  - Namespace [core/v1]
  - About Metadata APIs
  - ControllerRevision [apps/v1]
  - ComponentStatus [core/v1]
  - Binding [core/v1]
  - ConfigMap [core/v1]
  - APIRequestCount [apiserver.openshift.io/v1]
  - Lease [coordination.k8s.io/v1]
- Monitoring APIs
  - PrometheusRule [monitoring.coreos.com/v1]
  - Prometheus [monitoring.coreos.com/v1]
  - Alertmanager [monitoring.coreos.com/v1]
  - PodMonitor [monitoring.coreos.com/v1]
  - AlertmanagerConfig [monitoring.coreos.com/v1alpha1]
  - ThanosRuler [monitoring.coreos.com/v1]
  - Probe [monitoring.coreos.com/v1]
  - About Monitoring APIs
  - ServiceMonitor [monitoring.coreos.com/v1]
- Network APIs
  - HostSubnet [network.openshift.io/v1]
  - IngressClass [networking.k8s.io/v1]
  - Endpoints [core/v1]
  - Service [core/v1]
  - Ingress [networking.k8s.io/v1]
  - NetworkPolicy [networking.k8s.io/v1]
  - About Network APIs
  - NetNamespace [network.openshift.io/v1]
  - NetworkAttachmentDefinition [k8s.cni.cncf.io/v1]
  - PodNetworkConnectivityCheck [controlplane.operator.openshift.io/v1alpha1]
  - IPPool [whereabouts.cni.cncf.io/v1alpha1]
  - Route [route.openshift.io/v1]
  - EgressRouter [network.operator.openshift.io/v1]
  - EndpointSlice [discovery.k8s.io/v1]
  - EgressNetworkPolicy [network.openshift.io/v1]
  - ClusterNetwork [network.openshift.io/v1]
- Node APIs
  - Node [core/v1]
  - Tuned [tuned.openshift.io/v1]
  - RuntimeClass [node.k8s.io/v1]
  - Profile [tuned.openshift.io/v1]
  - About Node APIs
- OAuth APIs
  - OAuthAuthorizeToken [oauth.openshift.io/v1]
  - OAuthAccessToken [oauth.openshift.io/v1]
  - About OAuth APIs
  - OAuthClientAuthorization [oauth.openshift.io/v1]
  - UserOAuthAccessToken [oauth.openshift.io/v1]
  - OAuthClient [oauth.openshift.io/v1]
- Operator APIs
  - ServiceCA [operator.openshift.io/v1]
  - OpenShiftControllerManager [operator.openshift.io/v1]
  - DNS [operator.openshift.io/v1]
  - CSISnapshotController [operator.openshift.io/v1]
  - Console [operator.openshift.io/v1]
  - Config [operator.openshift.io/v1]
  - Config [samples.operator.openshift.io/v1]
  - OperatorPKI [network.operator.openshift.io/v1]
  - Network [operator.openshift.io/v1]
  - CloudCredential [operator.openshift.io/v1]
  - ClusterCSIDriver [operator.openshift.io/v1]
  - DNSRecord [ingress.operator.openshift.io/v1]
  - IngressController [operator.openshift.io/v1]
  - ImagePruner [imageregistry.operator.openshift.io/v1]
  - About Operator APIs
  - OpenShiftAPIServer [operator.openshift.io/v1]
  - Storage [operator.openshift.io/v1]
  - KubeControllerManager [operator.openshift.io/v1]
  - KubeAPIServer [operator.openshift.io/v1]
  - Config [imageregistry.operator.openshift.io/v1]
  - Authentication [operator.openshift.io/v1]
  - KubeStorageVersionMigrator [operator.openshift.io/v1]
  - ImageContentSourcePolicy [operator.openshift.io/v1alpha1]
  - KubeScheduler [operator.openshift.io/v1]
  - Etcd [operator.openshift.io/v1]
- OperatorHub APIs
  - Subscription [operators.coreos.com/v1alpha1]
  - OperatorGroup [operators.coreos.com/v1]
  - About OperatorHub APIs
  - Operator [operators.coreos.com/v1]
  - ClusterServiceVersion [operators.coreos.com/v1alpha1]
  - InstallPlan [operators.coreos.com/v1alpha1]
  - OperatorCondition [operators.coreos.com/v1]
  - PackageManifest [packages.operators.coreos.com/v1]
  - CatalogSource [operators.coreos.com/v1alpha1]
- Policy APIs
  - About Policy APIs
  - PodDisruptionBudget [policy/v1]
- Project APIs
  - ProjectRequest [project.openshift.io/v1]
  - About Project APIs
  - Project [project.openshift.io/v1]
- Provisioning APIs
  - BareMetalHost [metal3.io/v1alpha1]
  - About Provisioning APIs
  - Provisioning [metal3.io/v1alpha1]
- RBAC APIs
  - ClusterRole [rbac.authorization.k8s.io/v1]
  - ClusterRoleBinding [rbac.authorization.k8s.io/v1]
  - Role [rbac.authorization.k8s.io/v1]
  - About RBAC APIs
  - RoleBinding [rbac.authorization.k8s.io/v1]
- Role APIs
  - About Role APIs
  - Role [authorization.openshift.io/v1]
  - RoleBinding [authorization.openshift.io/v1]
  - RoleBindingRestriction [authorization.openshift.io/v1]
  - ClusterRole [authorization.openshift.io/v1]
  - ClusterRoleBinding [authorization.openshift.io/v1]
- Schedule and quota APIs
  - FlowSchema [flowcontrol.apiserver.k8s.io/v1beta1]
  - LimitRange [core/v1]
  - ResourceQuota [core/v1]
  - About Schedule and quota APIs
  - PriorityLevelConfiguration [flowcontrol.apiserver.k8s.io/v1beta1]
  - PriorityClass [scheduling.k8s.io/v1]
  - ClusterResourceQuota [quota.openshift.io/v1]
  - AppliedClusterResourceQuota [quota.openshift.io/v1]
- Security APIs
  - Secret [core/v1]
  - PodSecurityPolicySubjectReview [security.openshift.io/v1]
  - CredentialsRequest [cloudcredential.openshift.io/v1]
  - CertificateSigningRequest [certificates.k8s.io/v1]
  - ServiceAccount [core/v1]
  - About Security APIs
  - SecurityContextConstraints [security.openshift.io/v1]
  - RangeAllocation [security.openshift.io/v1]
  - PodSecurityPolicyReview [security.openshift.io/v1]
  - PodSecurityPolicySelfSubjectReview [security.openshift.io/v1]
- Storage APIs
  - CSINode [storage.k8s.io/v1]
  - StorageVersionMigration [migration.k8s.io/v1alpha1]
  - CSIDriver [storage.k8s.io/v1]
  - VolumeAttachment [storage.k8s.io/v1]
  - About Storage APIs
  - StorageClass [storage.k8s.io/v1]
  - StorageState [migration.k8s.io/v1alpha1]
  - VolumeSnapshotClass [snapshot.storage.k8s.io/v1]
  - VolumeSnapshotContent [snapshot.storage.k8s.io/v1]
  - PersistentVolumeClaim [core/v1]
  - CSIStorageCapacity [storage.k8s.io/v1beta1]
  - VolumeSnapshot [snapshot.storage.k8s.io/v1]
- Template APIs
  - BrokerTemplateInstance [template.openshift.io/v1]
  - Template [template.openshift.io/v1]
  - TemplateInstance [template.openshift.io/v1]
  - About Template APIs
  - PodTemplate [core/v1]
- User and group APIs
  - UserIdentityMapping [user.openshift.io/v1]
  - Identity [user.openshift.io/v1]
  - User [user.openshift.io/v1]
  - Group [user.openshift.io/v1]
  - About User and group APIs
- Workloads APIs
  - Deployment [apps/v1]
  - Pod [core/v1]
  - DaemonSet [apps/v1]
  - StatefulSet [apps/v1]
  - Build [build.openshift.io/v1]
  - PersistentVolume [core/v1]
  - About Workloads APIs
  - ReplicaSet [apps/v1]
  - DeploymentConfig [apps.openshift.io/v1]
  - CronJob [batch/v1]
  - Job [batch/v1]
  - ReplicationController [core/v1]
  - BuildConfig [build.openshift.io/v1]
Architecture
- Installation and update
- The control plane
- Understanding OKD development
- Product architecture
- Fedora CoreOS
Authentication and authorization
- Using bound service account tokens
- Configuring OAuth clients
- Understanding identity provider configuration
- Understanding and creating service accounts
- Removing the kubeadmin user
- Configuring the internal OAuth server
- Syncing LDAP groups
- Using a service account as an OAuth client
- Using RBAC to define and apply permissions
- Understanding authentication
- Managing security context constraints
- Managing user-owned OAuth access tokens
- Scoping tokens
- Creating and using config maps
- Impersonating the system:admin user
- Managing cloud provider credentials
- Using service accounts in applications
- Configuring identity providers
Backup and restore
- Replacing an unhealthy etcd member
- Shutting down a cluster gracefully
- Restarting a cluster gracefully
- Disaster recovery
- Backing up etcd data
Building Applications
- Idling applications
- Using the Red Hat Marketplace
- Monitoring application health
- Viewing application composition using the Topology view
- Pruning objects to reclaim resources
- Monitoring project and application metrics using the Developer perspective
- Editing applications
- Creating Applications
- Deployments
- Projects
- Quotas
  - Resource quotas per project
  - Resource quotas across multiple projects
- Working with Helm charts
- Deleting applications
CI/CD
- Builds
CLI tools
- Knative CLI (kn) for use with OpenShift Serverless
- CLI tools overview
- Developer CLI (odo)
- OpenShift CLI (oc)
- Operator SDK
  - Operator SDK CLI reference
  - Installing the Operator SDK CLI
- opm CLI
Images
- Configuring the Cluster Samples Operator
- Creating images
- Using Ruby on Rails
- Managing image streams
- Triggering updates on image stream changes
- Using templates
- Understanding containers, images, and imagestreams
- Using the Cluster Samples Operator with an alternate registry
- Using image streams with Kubernetes resources
- Image configuration resources
- Managing images
- Using images
Installing
- Validating an installation
- Selecting an installation method and preparing a cluster
- Installation overview
- Troubleshooting installation issues
- Mirroring images for a disconnected installation
- Installation configuration
  - Configuring your firewall
  - Customizing nodes
- Installing on any platform
  - Installing a cluster on any platform
- Installing on AWS
- Installing on Azure
- Installing on bare metal
- Installing on GCP
- Installing on OpenStack
- Installing on VMC
- Installing on vSphere
- Deploying installer-provisioned clusters on bare metal
Logging
- Forwarding logs to third party systems
- Collecting and storing Kubernetes events
- Viewing cluster dashboards
- Release notes
- Exported fields
- Installing Logging
- Viewing logs for a specific resource
- About Logging
- Updating Logging
- Viewing cluster logs in Kibana
- Enabling JSON logging
- Uninstalling Logging
- Configuring your Logging deployment
- Troubleshooting Logging
Machine management
- Manually scaling a machine set
- Modifying a machine set
- Deploying machine health checks
- Creating infrastructure machine sets
- User-provisioned infrastructure
- Applying autoscaling to a cluster
- Deleting a machine
- Creating machine sets
Migrating from version 3 to 4
- Troubleshooting
- Advanced migration options
- About MTC
- Migrating your applications
- Premigration checklists
- Upgrading MTC
- Installing MTC
- Differences between OKD 3 and 4
- About migrating from OKD 3 to 4
- Installing MTC in a restricted network environment
Migration Toolkit for Containers
- Installing MTC
- Premigration checklists
- Migrating your applications
- Troubleshooting
- Installing MTC in a restricted network environment
- MTC release notes
- About MTC
- Upgrading MTC
- Advanced migration options
Monitoring
- Troubleshooting monitoring issues
- Reviewing monitoring dashboards
- Managing alerts
- Configuring the monitoring stack
- Enabling monitoring for user-defined projects
- Accessing third-party UIs
- Managing metrics
- Understanding the monitoring stack
Networking
- Configuring a custom PKI
- About the Contour Operator
- Understanding the DNS Operator
- Load balancing on OpenStack
- Understanding the Ingress Operator
- Accessing hosts
- Understanding the Cluster Network Operator
- Associating secondary interfaces metrics to network attachments
- Configuring PTP hardware
- Configuring the cluster-wide proxy
- Configuring the node port service range
- Configuring IP failover
- Understanding networking
- Using SCTP
- Verifying connectivity to an endpoint
- OpenShift SDN default CNI network provider
  - Configuring an egress firewall for a project
  - Configuring kube-proxy
  - Removing an egress firewall from a project
  - Considerations for the use of an egress router pod
  - Configuring egress IPs for a project
  - Deploying an egress router pod in HTTP proxy mode
  - Enabling multicast for a project
  - Deploying an egress router pod in redirect mode
  - Viewing an egress firewall for a project
  - Editing an egress firewall for a project
  - Disabling multicast for a project
  - Configuring an egress router pod destination list from a config map
  - Configuring multitenant isolation
  - Deploying an egress router pod in DNS proxy mode
  - About the OpenShift SDN default CNI network provider
- Configuring ingress cluster traffic
  - Configuring ingress cluster traffic using an Ingress Controller
  - Overview
  - Configuring ExternalIPs for services
  - Configuring ingress cluster traffic using a service external IP
  - Configuring ingress cluster traffic on AWS using a Network Load Balancer
  - Configuring ingress cluster traffic using a load balancer
  - Configuring ingress cluster traffic using a NodePort
- Configuring Routes
  - Secured routes
  - Route configuration
- Hardware networks
  - Using DPDK and RDMA
  - Configuring an SR-IOV network device
  - Configuring the SR-IOV Operator
  - Adding a pod to an SR-IOV network
  - Installing the SR-IOV Operator
  - Configuring an SR-IOV InfiniBand network attachment
  - Using high performance multicast
  - Configuring an SR-IOV Ethernet network attachment
  - About Single Root I/O Virtualization (SR-IOV) hardware networks
- Kubernetes NMState
  - Updating node network configuration
  - Troubleshooting node network configuration
  - Observing node network state
  - About the Kubernetes NMState Operator
- Multiple networks
  - Configuring an ipvlan network
  - Configuring a macvlan network with basic customizations
  - Configuring a macvlan network
  - About virtual routing and forwarding
  - Removing a pod from an additional network
  - Attaching a pod to an additional network
  - Configuring multi-network policy
  - Understanding multiple networks
  - Configuring a host-device network
  - Editing an additional network
  - Removing an additional network
  - Configuring a bridge network
  - Assigning a secondary network to a VRF
- Network policy
  - Configuring multitenant network policy
  - Defining a default network policy for projects
  - Editing a network policy
  - Creating a network policy
  - Viewing a network policy
  - Logging network policy
  - Deleting a network policy
  - About network policy
- OVN-Kubernetes default CNI network provider
  - Tracking network flows
  - Viewing an egress firewall for a project
  - About the OVN-Kubernetes network provider
  - Enabling multicast for a project
  - Disabling multicast for a project
  - Considerations for the use of an egress router pod
  - Migrating from the OpenShift SDN cluster network provider
  - Assigning an egress IP address
  - Deploying an egress router pod in redirect mode
  - IPsec encryption configuration
  - Converting to IPv4/IPv6 dual stack networking
  - Configuring an egress IP address
  - Configuring hybrid networking
  - Removing an egress firewall from a project
  - Editing an egress firewall for a project
  - Configuring an egress firewall for a project
  - Rolling back to the OpenShift SDN cluster network provider
Nodes
- Overview of nodes
- Controlling pod placement onto nodes (scheduling)
- Using Jobs and DaemonSets
  - Running background tasks on nodes automatically with daemonsets
  - Running tasks in pods using jobs
- Working with clusters
- Working with containers
- Working with nodes
- Working with pods
Operators
- Red Hat Operators reference
- Administrator tasks
- Developing Operators
- Understanding Operators
- User tasks
  - Installing Operators in your namespace
  - Creating applications from installed Operators
Post-installation configuration
- Storage configuration
- Post-installation configuration overview
- Configuring alert notifications
- Network configuration
- Configuring a private cluster
- Node tasks
- Preparing for users
- Machine configuration tasks
- Cluster tasks
Registry
- Registry options
- Accessing the registry
- Exposing the registry
- Overview
- Image Registry Operator in OKD
- Setting up and configuring the registry
Scalability and performance
- Recommended cluster scaling practices
- Using Topology Manager
- The Driver Toolkit
- Recommended installation practices
- Managing bare metal hosts
- What huge pages do and how they are consumed by apps
- Planning your environment according to object maximums
- Optimizing networking
- Performance Addon Operator for low latency nodes
- Using Cluster Loader
- The Node Feature Discovery Operator
- Optimizing storage
- Using CPU Manager
- Creating a performance profile
- Recommended host practices
- Optimizing routing
- Scaling the Cluster Monitoring Operator
- Using the Node Tuning Operator
Security and compliance
- Configuring the audit log policy
- Encrypting etcd data
- Scanning pods for vulnerabilities
- Security and compliance overview
- Viewing audit logs
- Allowing JavaScript-based access to the API server from additional hosts
- Configuring TLS security profiles
- Configuring seccomp profiles
- Compliance Operator
- Configuring certificates
- Container security
- File Integrity Operator
- Certificate types and descriptions
Storage
- Understanding persistent storage
- Dynamic provisioning
- Expanding persistent volumes
- Understanding ephemeral storage
- Configuring persistent storage
- Using Container Storage Interface (CSI)
Support
- Getting support
- Summarizing cluster specifications
- Gathering data about your cluster
- Remote health monitoring with connected clusters
- Troubleshooting
Updating clusters
- Understanding the OpenShift Update Service
- Updating a cluster between minor versions
- Updating a cluster within a minor version by using the CLI
- Updating a cluster within a minor version from the web console
- Performing update using canary rollout strategy
- Installing and configuring the OpenShift Update Service
Web console
- Web terminal
- Creating quick start tutorials
- Accessing the web console
- Configuring the web console
- Disabling the web console
- Customizing the web console
- Viewing cluster information
- Developer perspective
What’s new?
- Deprecated features
- New features and enhancements
Windows Container Support for OpenShift
- Windows Container Support for OpenShift release notes
- Using Bring-Your-Own-Host Windows instances as nodes
- Disabling Windows container workloads
- Windows node upgrades
- Understanding Windows container workloads
- Removing Windows nodes
- Scheduling Windows container workloads
- Enabling Windows container workloads
- Creating Windows MachineSet objects

暂无相关搜索结果！

本文档使用全库网构建