kubernetes
/
website
mirror of https://github.com/kubernetes/website.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Merge pull request #46113 from nilekhc/clarify-automatic-reloading 

docs: updates automatics reloading behaviour.
pull/46375/head
Kubernetes Prow Robot 2024-05-14 10:19:11 -07:00 committed by GitHub
parent d06c906d2b 87a912068c
commit 8901aa537e
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 10 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
content/en/docs/tasks/administer-cluster/encrypt-data.md
View File

@ -719,7 +719,12 @@ allows you to change the keys for encryption at rest without restarting the
API server. API server.
To allow automatic reloading, configure the API server to run with: To allow automatic reloading, configure the API server to run with:
`--encryption-provider-config-automatic-reload=true` `--encryption-provider-config-automatic-reload=true`.
When enabled, file changes are polled every minute to observe the modifications.
The `apiserver_encryption_config_controller_automatic_reload_last_timestamp_seconds`
metric identifies when the new config becomes effective. This allows
encryption keys to be rotated without restarting the API server.
## {{% heading "whatsnext" %}} ## {{% heading "whatsnext" %}}

5
content/en/docs/tasks/administer-cluster/kms-provider.md
View File

@ -264,7 +264,10 @@ defined in a CustomResourceDefinition, your cluster must be running Kubernetes v
1. Set the `--encryption-provider-config` flag on the kube-apiserver to point to the location of the configuration file. 1. Set the `--encryption-provider-config` flag on the kube-apiserver to point to the location of the configuration file.
1. `--encryption-provider-config-automatic-reload` boolean argument determines if the file set by `--encryption-provider-config` should be automatically reloaded if the disk contents change. This enables key rotation without API server restarts. 1. `--encryption-provider-config-automatic-reload` boolean argument
determines if the file set by `--encryption-provider-config` should be
[automatically reloaded](/docs/tasks/administer-cluster/encrypt-data/#configure-automatic-reloading)
if the disk contents change.
1. Restart your API server. 1. Restart your API server.