Merge pull request #9781 from johngmyers/update-notes

Add release note about cert expiration

docs/releases/1.19-NOTES.md

@@ -29,13 +29,17 @@ If you already have a default `StorageClass`, you should set `cloudConfig.Openst
 
 * Clusters using the Amazon VPC CNI provider now perform an `ec2.DescribeInstanceTypes` call at instance launch time. In large clusters or AWS accounts this may lead to API throttling which could delay node readiness. If this becomes a problem please open a GitHub issue.
 
-* Alpha support for Hashicorp Vault as store for secrets and keys. See the [Vault state store docs](/state/#vault-vault).
+* There is now Alpha support for Hashicorp Vault as a store for secrets and keys. See the [Vault state store docs](/state/#vault-vault).
 
-* New clusters running Cilium will have enabled BPF NodePort by default if kubernetes version is 1.12 or newer.
+* New clusters running Cilium now enable BPF NodePort by default if the Kubernetes version is 1.12 or newer.
 
 * The `kops update cluster` command will now refuse to run on a cluster that
 has been updated by a newer version of kops unless it is given the `--allow-kops-downgrade` flag.
 
+* The lifetimes of certificates used by various components have been substantially reduced.
+The certificates on a node will expire sometime between 455 and 485 days after the node's creation.
+The expiration times vary randomly so that nodes are likely to have their certs expire at different times than other nodes.
+
 # Breaking changes
 
 * Support for Kubernetes 1.9 and 1.10 has been removed.
@@ -46,7 +50,7 @@ has been updated by a newer version of kops unless it is given the `--allow-kops
 
 # Required Actions
 
-* See note about Openstack Cinder plugin above.
+* See note about [Openstack Cinder plugin](#openstack-cinder-plugin) above.
 
 # Deprecations