Chapter 2. Responsive restarts and security certificates

Red Hat build of MicroShift depends on device IP addresses and system-wide clock settings to remain consistent during its runtime. However, these settings may occasionally change on edge devices, such as DHCP or Network Time Protocol (NTP) updates.

When such changes occur, some Red Hat build of MicroShift components may stop functioning properly. To mitigate this situation, Red Hat build of MicroShift monitors the IP address and system time and restarts if either setting change is detected.

The threshold for clock changes is a time adjustment of greater than 10 seconds in either direction. Smaller drifts on regular time adjustments performed by the Network Time Protocol (NTP) service do not cause a restart.

Red Hat build of MicroShift certificates are separated into two basic groups:

Most server or leaf certificates are short-lived.

An example of a long-lived certificate is the client certificate for system:admin user authentication, or the certificate of the signer of the kube-apiserver external serving certificate.

2.2.1. Certificate rotation

Copia collegamento

As certificates age, Red Hat build of MicroShift can be restarted to rotate certificates. A certificate that is close to expiring might also automatically cause a restart. Read the following situation overviews to understand the actions at each moment in time:

1. Green zone:

   1. When a short-term certificate is 5 months old, no rotation occurs.
   2. When a long-term certificate is 8.5 years old, no rotation occurs.

2. Yellow zone:

   1. When a short-term certificate is 8 months old, it is rotated when Red Hat build of MicroShift starts or restarts.
   2. When a long-term certificate is 9 years old, it is rotated when Red Hat build of MicroShift starts or restarts.

3. Red zone

   1. When a short-term certificate is 8 months old, Red Hat build of MicroShift restarts to rotate and apply a new certificate.
   2. When a long-term certificate is 9 years old, Red Hat build of MicroShift restarts to rotate and apply a new certificate.

Note

If the rotated certificate is a Certificate Authority, all of the certificates it signed rotate.

Figure 2.1. Stoplight timeline of Red Hat build of MicroShift certificate validity.

View larger image