From 8452020ed676814c4de7b7750ce41cc73d3bab9c Mon Sep 17 00:00:00 2001 From: William Gabor Date: Mon, 20 Jul 2026 14:20:50 -0400 Subject: [PATCH] OSDOCS-17172-agg-api-client-certs CQA --- .../aggregated-api-client-certificates.adoc | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/security/certificate_types_descriptions/aggregated-api-client-certificates.adoc b/security/certificate_types_descriptions/aggregated-api-client-certificates.adoc index 213351c82775..8ccd567bec33 100644 --- a/security/certificate_types_descriptions/aggregated-api-client-certificates.adoc +++ b/security/certificate_types_descriptions/aggregated-api-client-certificates.adoc @@ -6,21 +6,29 @@ include::_attributes/common-attributes.adoc[] toc::[] +[role="_abstract"] +Review aggregated API client certificate validity and automatic rotation in {product-title} to plan maintenance for extension API server authentication. + +[id="aggregated-api-client-certificates-purpose_{context}"] == Purpose -Aggregated API client certificates are used to authenticate the KubeAPIServer when connecting to the Aggregated API Servers. +Aggregated API client certificates are used to authenticate the `KubeAPIServer` when connecting to the aggregated API servers. +[id="aggregated-api-client-certificates-management_{context}"] == Management These certificates are managed by the system and not the user. +[id="aggregated-api-client-certificates-expiration_{context}"] == Expiration -This CA is valid for 30 days. + +This certificate authority (CA) is valid for 30 days. The managed client certificates are valid for 30 days. CA and client certificates are rotated automatically through the use of controllers. +[id="aggregated-api-client-certificates-customization_{context}"] == Customization You cannot customize the aggregated API server certificates.