Skip to content

[enterprise-4.21] OSDOCS-17172-agg-api-client-certs CQA #116124

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lahinson merged 1 commit into from
Jul 22, 2026
Merged

[enterprise-4.21] OSDOCS-17172-agg-api-client-certs CQA #116124

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions security/certificate_types_descriptions/aggregated-api-client-certificates.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,21 +6,29 @@ include::_attributes/common-attributes.adoc[]

toc::[]

[role="_abstract"]
Review aggregated API client certificate validity and automatic rotation in {product-title} to plan maintenance for extension API server authentication.

[id="aggregated-api-client-certificates-purpose_{context}"]
== Purpose

Aggregated API client certificates are used to authenticate the KubeAPIServer when connecting to the Aggregated API Servers.
Aggregated API client certificates are used to authenticate the `KubeAPIServer` when connecting to the aggregated API servers.

[id="aggregated-api-client-certificates-management_{context}"]
== Management

These certificates are managed by the system and not the user.

[id="aggregated-api-client-certificates-expiration_{context}"]
== Expiration
This CA is valid for 30 days.

This certificate authority (CA) is valid for 30 days.

The managed client certificates are valid for 30 days.

CA and client certificates are rotated automatically through the use of controllers.

[id="aggregated-api-client-certificates-customization_{context}"]
== Customization

You cannot customize the aggregated API server certificates.