kind/feature
What would you like to be added:
When writing the guide for manually rotating Karmada certificates, I found that the operation is too complicated and not easy to execute reliably. Since different Karmada installation tools already have built-in capabilities to generate certificates and mount the corresponding Secrets, can we package these capabilities as a certificate rotation feature?
Taking karmadactl init as an example, we can add a flag such as --cert-mode. When its value is rotate, karmadactl init will start the certificate rotation process and replace the related Secrets, instead of performing a normal installation.
We can first focuses only on karmadactl init.
For example:
karmadactl init --cert-mode=rotate <other flags consistent with the original installation>
After the Secrets are updated, users only need to restart the related Karmada components to make the new certificates take effect.
Another benefit is that users only need to keep the other flags consistent between the original installation and the rotation operation. In this way, the certificate configuration used for rotation can remain consistent with the original installation.
Why is this needed:
Manual certificate rotation for Karmada is complex and has low executability.
The main reasons are:
- Karmada has many components, so there are many related certificates and Secrets.
- For different installation methods, the Secret names and mount paths used by certificates may be different.
- If users customized certificate-related configurations during installation, it is difficult to synchronize these configurations when manually generating new certificates.
These details make manual certificate rotation difficult for users to understand and operate correctly.
Since Karmada installation tools already know how to generate certificates and mount Secrets for their own installation method, reusing this ability for certificate rotation can greatly reduce the operation complexity and make certificate rotation more practical and reliable.
proposal and tasks are tracked by #7690
kind/feature
What would you like to be added:
When writing the guide for manually rotating Karmada certificates, I found that the operation is too complicated and not easy to execute reliably. Since different Karmada installation tools already have built-in capabilities to generate certificates and mount the corresponding Secrets, can we package these capabilities as a certificate rotation feature?
Taking
karmadactl initas an example, we can add a flag such as--cert-mode. When its value isrotate,karmadactl initwill start the certificate rotation process and replace the related Secrets, instead of performing a normal installation.We can first focuses only on
karmadactl init.For example:
After the Secrets are updated, users only need to restart the related Karmada components to make the new certificates take effect.
Another benefit is that users only need to keep the other flags consistent between the original installation and the rotation operation. In this way, the certificate configuration used for rotation can remain consistent with the original installation.
Why is this needed:
Manual certificate rotation for Karmada is complex and has low executability.
The main reasons are:
These details make manual certificate rotation difficult for users to understand and operate correctly.
Since Karmada installation tools already know how to generate certificates and mount Secrets for their own installation method, reusing this ability for certificate rotation can greatly reduce the operation complexity and make certificate rotation more practical and reliable.
proposal and tasks are tracked by #7690