Skip to content

Commit 282383f

Browse files
DiogoFerraoDiogoFerrao
authored
Add support for SKE new credentials rotation flow (#186)
* SKE Credentials Rotation: start-rotation command (#179) * initial start rotation command implementation * update go mod, rename files, generate docs * start-rotation update long description * Improve start-rotation documentation * SKE Credentials Rotation: complete-rotation command (#181) * initial complete rotation command * complete rotation command: improve documentation * improve documentation * SKE Credentials Rotation: kubeconfig create command (#184) * initial kubeconfig create command * finish create command implementation, add testing * fix linting, generate docs * address PR comments * extract funcs to utils, add testing * improve function documentation * fix linting * address PR comments, minor improvements * make utils testing work on all OSes * SKE Credentials Rotation: fixes and improvements (#188) * improve docs * Improve documentation, address acceptance comments * fix testing, finish renaming filepath flag * SKE Credentials Rotation: deprecate old commands (#191) * deprecate describe and rotate commands * improve deprecation messages, add docs * SKE Credentials Rotation: deprecate old commands improvements (#192) * remove example cluster name from deprecation message * address comments
1 parent 386982b commit 282383f

21 files changed

+1544
-81
lines changed

‎docs/stackit_ske.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,5 +33,6 @@ stackit ske [flags]
3333
* [stackit ske describe](./stackit_ske_describe.md) - Shows overall details regarding SKE
3434
* [stackit ske disable](./stackit_ske_disable.md) - Disables SKE for a project
3535
* [stackit ske enable](./stackit_ske_enable.md) - Enables SKE for a project
36+
* [stackit ske kubeconfig](./stackit_ske_kubeconfig.md) - Provides functionality for SKE kubeconfig
3637
* [stackit ske options](./stackit_ske_options.md) - Lists SKE provider options
3738

‎docs/stackit_ske_credentials.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,6 @@ stackit ske credentials [flags]
2828
### SEE ALSO
2929

3030
* [stackit ske](./stackit_ske.md) - Provides functionality for SKE
31-
* [stackit ske credentials describe](./stackit_ske_credentials_describe.md) - Shows details of the credentials associated to a SKE cluster
32-
* [stackit ske credentials rotate](./stackit_ske_credentials_rotate.md) - Rotates credentials associated to a SKE cluster
31+
* [stackit ske credentials complete-rotation](./stackit_ske_credentials_complete-rotation.md) - Completes the rotation of the credentials associated to a SKE cluster
32+
* [stackit ske credentials start-rotation](./stackit_ske_credentials_start-rotation.md) - Starts the rotation of the credentials associated to a SKE cluster
3333

‎docs/stackit_ske_credentials_complete-rotation.md‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
## stackit ske credentials complete-rotation
2+
3+
Completes the rotation of the credentials associated to a SKE cluster
4+
5+
### Synopsis
6+
7+
Completes the rotation of the credentials associated to a STACKIT Kubernetes Engine (SKE) cluster.
8+
9+
This is step 2 of a 2-step process to rotate all SKE cluster credentials. Tasks accomplished in this phase include:
10+
- The old certification authority will be dropped from the package.
11+
- The old signing key for the service account will be dropped from the bundle.
12+
To ensure continued access to the Kubernetes cluster, please update your kubeconfig with the new credentials:
13+
$ stackit ske kubeconfig create my-cluster
14+
15+
If you haven't, please start the process by running:
16+
$ stackit ske credentials start-rotation my-cluster
17+
For more information, visit: https://docs.stackit.cloud/stackit/en/how-to-rotate-ske-credentials-200016334.html
18+
19+
```
20+
stackit ske credentials complete-rotation CLUSTER_NAME [flags]
21+
```
22+
23+
### Examples
24+
25+
```
26+
Complete the rotation of the credentials associated to the SKE cluster with name "my-cluster"
27+
$ stackit ske credentials complete-rotation my-cluster
28+
29+
Flow of the 2-step process to rotate all SKE cluster credentials, including generating a new kubeconfig file
30+
$ stackit ske credentials start-rotation my-cluster
31+
$ stackit ske kubeconfig create my-cluster
32+
$ stackit ske credentials complete-rotation my-cluster
33+
```
34+
35+
### Options
36+
37+
```
38+
-h, --help Help for "stackit ske credentials complete-rotation"
39+
```
40+
41+
### Options inherited from parent commands
42+
43+
```
44+
-y, --assume-yes If set, skips all confirmation prompts
45+
--async If set, runs the command asynchronously
46+
-o, --output-format string Output format, one of ["json" "pretty"]
47+
-p, --project-id string Project ID
48+
```
49+
50+
### SEE ALSO
51+
52+
* [stackit ske credentials](./stackit_ske_credentials.md) - Provides functionality for SKE credentials
53+

‎docs/stackit_ske_credentials_describe.md‎

Lines changed: 0 additions & 41 deletions
This file was deleted.

‎docs/stackit_ske_credentials_rotate.md‎

Lines changed: 0 additions & 38 deletions
This file was deleted.

‎docs/stackit_ske_credentials_start-rotation.md‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
## stackit ske credentials start-rotation
2+
3+
Starts the rotation of the credentials associated to a SKE cluster
4+
5+
### Synopsis
6+
7+
Starts the rotation of the credentials associated to a STACKIT Kubernetes Engine (SKE) cluster.
8+
9+
This is step 1 of a 2-step process to rotate all SKE cluster credentials. Tasks accomplished in this phase include:
10+
- Rolling recreation of all worker nodes
11+
- A new Certificate Authority (CA) will be established and incorporated into the existing CA bundle.
12+
- A new etcd encryption key is generated and added to the Certificate Authority (CA) bundle.
13+
- A new signing key will be generated for the service account and added to the Certificate Authority (CA) bundle.
14+
- The kube-apiserver will rewrite all secrets in the cluster, encrypting them with the new encryption key.
15+
The old CA, encryption key and signing key will be retained until the rotation is completed.
16+
17+
After completing the rotation of credentials, you can generate a new kubeconfig file by running:
18+
$ stackit ske kubeconfig create my-cluster
19+
Complete the rotation by running:
20+
$ stackit ske credentials complete-rotation my-cluster
21+
For more information, visit: https://docs.stackit.cloud/stackit/en/how-to-rotate-ske-credentials-200016334.html
22+
23+
```
24+
stackit ske credentials start-rotation CLUSTER_NAME [flags]
25+
```
26+
27+
### Examples
28+
29+
```
30+
Start the rotation of the credentials associated to the SKE cluster with name "my-cluster"
31+
$ stackit ske credentials start-rotation my-cluster
32+
33+
Flow of the 2-step process to rotate all SKE cluster credentials, including generating a new kubeconfig file
34+
$ stackit ske credentials start-rotation my-cluster
35+
$ stackit ske kubeconfig create my-cluster
36+
$ stackit ske credentials complete-rotation my-cluster
37+
```
38+
39+
### Options
40+
41+
```
42+
-h, --help Help for "stackit ske credentials start-rotation"
43+
```
44+
45+
### Options inherited from parent commands
46+
47+
```
48+
-y, --assume-yes If set, skips all confirmation prompts
49+
--async If set, runs the command asynchronously
50+
-o, --output-format string Output format, one of ["json" "pretty"]
51+
-p, --project-id string Project ID
52+
```
53+
54+
### SEE ALSO
55+
56+
* [stackit ske credentials](./stackit_ske_credentials.md) - Provides functionality for SKE credentials
57+

‎docs/stackit_ske_kubeconfig.md‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
## stackit ske kubeconfig
2+
3+
Provides functionality for SKE kubeconfig
4+
5+
### Synopsis
6+
7+
Provides functionality for STACKIT Kubernetes Engine (SKE) kubeconfig.
8+
9+
```
10+
stackit ske kubeconfig [flags]
11+
```
12+
13+
### Options
14+
15+
```
16+
-h, --help Help for "stackit ske kubeconfig"
17+
```
18+
19+
### Options inherited from parent commands
20+
21+
```
22+
-y, --assume-yes If set, skips all confirmation prompts
23+
--async If set, runs the command asynchronously
24+
-o, --output-format string Output format, one of ["json" "pretty"]
25+
-p, --project-id string Project ID
26+
```
27+
28+
### SEE ALSO
29+
30+
* [stackit ske](./stackit_ske.md) - Provides functionality for SKE
31+
* [stackit ske kubeconfig create](./stackit_ske_kubeconfig_create.md) - Creates a kubeconfig for an SKE cluster
32+

‎docs/stackit_ske_kubeconfig_create.md‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
## stackit ske kubeconfig create
2+
3+
Creates a kubeconfig for an SKE cluster
4+
5+
### Synopsis
6+
7+
Creates a kubeconfig for a STACKIT Kubernetes Engine (SKE) cluster.
8+
9+
By default the kubeconfig is created in the .kube folder, in the user's home directory. The kubeconfig file will be overwritten if it already exists.
10+
You can override this behavior by specifying a custom filepath with the --filepath flag.
11+
An expiration time can be set for the kubeconfig. The expiration time is set in seconds(s), minutes(m), hours(h), days(d) or months(M). Default is 1h.
12+
Note that the format is <value><unit>, e.g. 30d for 30 days and you can't combine units.
13+
14+
```
15+
stackit ske kubeconfig create CLUSTER_NAME [flags]
16+
```
17+
18+
### Examples
19+
20+
```
21+
Create a kubeconfig for the SKE cluster with name "my-cluster"
22+
$ stackit ske kubeconfig create my-cluster
23+
24+
Create a kubeconfig for the SKE cluster with name "my-cluster" and set the expiration time to 30 days
25+
$ stackit ske kubeconfig create my-cluster --expiration 30d
26+
27+
Create a kubeconfig for the SKE cluster with name "my-cluster" and set the expiration time to 2 months
28+
$ stackit ske kubeconfig create my-cluster --expiration 2M
29+
30+
Create a kubeconfig for the SKE cluster with name "my-cluster" in a custom filepath
31+
$ stackit ske kubeconfig create my-cluster --filepath /path/to/config
32+
```
33+
34+
### Options
35+
36+
```
37+
-e, --expiration string Expiration time for the kubeconfig in seconds(s), minutes(m), hours(h), days(d) or months(M). Example: 30d. By default, expiration time is 1h
38+
--filepath string Path to create the kubeconfig file. By default, the kubeconfig is created as 'config' in the .kube folder, in the user's home directory.
39+
-h, --help Help for "stackit ske kubeconfig create"
40+
```
41+
42+
### Options inherited from parent commands
43+
44+
```
45+
-y, --assume-yes If set, skips all confirmation prompts
46+
--async If set, runs the command asynchronously
47+
-o, --output-format string Output format, one of ["json" "pretty"]
48+
-p, --project-id string Project ID
49+
```
50+
51+
### SEE ALSO
52+
53+
* [stackit ske kubeconfig](./stackit_ske_kubeconfig.md) - Provides functionality for SKE kubeconfig
54+

0 commit comments

Comments
 (0)