Ability to change control plane certificates expiration date

[atsikham]

Changes are related to #1302. Documentation is updated with config description.

NOTE: it is not possible to use openssl_* modules at the moment - #1593
NOTE: kubelet.conf is not updated because according to documentation kubeadm configures kubelet for automatic certificate renewal. To verify that, navigate to /var/lib/kubelet/config.yaml file and check if rotateCertificates is true (default in kubeadm), also check if there are files with dates in /var/lib/kubelet/pki.

Cases need to be tested 'at least':

• single-master and HA installations
• renew: true and renew:false with different periods, including default
• when certificates are updated, they have the same structure and fields as before update:

# useful commands
* kubeadm alpha certs check-expiration

# certificates location - /etc/kubernetes/pki/
* openssl x509 -in apiserver.crt -text -noout

# certificates embed to config files also participate in update process
* grep 'client-certificate-data' /etc/kubernetes/controller-manager.conf | awk '{print $2}' | base64 -d | openssl x509 -text

• it's possible to renew certs by kubeadm manually after appying configuration by Epiphany: kubeadm alpha certs renew all

[mkyc]

Just one question.

[przemyslavic]

/azp run

[sk4zuzu]

@atsikham I've done some testing on the PR.

root@x1a1:/etc/kubernetes# find . -type f -path '*/pki/*.crt' | while read FILE; do echo $FILE && openssl x509 -in $FILE -text -noout | grep 'Not After'; done
./pki/front-proxy-client.crt
            Not After : Nov 12 12:13:28 2020 GMT
./pki/apiserver.crt
            Not After : Nov 12 12:13:27 2020 GMT
./pki/etcd/server.crt
            Not After : Nov 12 12:13:28 2020 GMT
./pki/etcd/healthcheck-client.crt
            Not After : Nov 12 12:13:27 2020 GMT
./pki/etcd/ca.crt
            Not After : Sep  2 10:00:49 2030 GMT
./pki/etcd/peer.crt
            Not After : Nov 12 12:13:28 2020 GMT
./pki/ca.crt
            Not After : Sep  2 10:00:48 2030 GMT
./pki/apiserver-etcd-client.crt
            Not After : Nov 12 12:13:27 2020 GMT
./pki/front-proxy-ca.crt
            Not After : Sep  2 10:00:48 2030 GMT
./pki/apiserver-kubelet-client.crt
            Not After : Nov 12 12:13:27 2020 GMT
root@x1a1:/etc/kubernetes# cd ../kubernetes-previous/
root@x1a1:/etc/kubernetes-previous# find . -type f -path '*/pki/*.crt' | while read FILE; do echo $FILE && openssl x509 -in $FILE -text -noout | grep 'Not After'; done
./pki/front-proxy-client.crt
            Not After : Sep  4 10:00:49 2021 GMT
./pki/apiserver.crt
            Not After : Sep  4 11:42:01 2021 GMT
./pki/etcd/server.crt
            Not After : Sep  4 10:00:49 2021 GMT
./pki/etcd/healthcheck-client.crt
            Not After : Sep  4 10:00:50 2021 GMT
./pki/etcd/ca.crt
            Not After : Sep  2 10:00:49 2030 GMT
./pki/etcd/peer.crt
            Not After : Sep  4 10:00:50 2021 GMT
./pki/ca.crt
            Not After : Sep  2 10:00:48 2030 GMT
./pki/apiserver-etcd-client.crt
            Not After : Sep  4 10:00:50 2021 GMT
./pki/front-proxy-ca.crt
            Not After : Sep  2 10:00:48 2030 GMT
./pki/apiserver-kubelet-client.crt
            Not After : Sep  4 10:00:48 2021 GMT

The bottom one is default renew: false, the upper one is renew: true + expiration_days: 69.
It seems all certs are updated and the time period is correct.
Good work! 👍

[sk4zuzu]

LGTM

[mkyc]

LGTM