Required periodic maintenance

This document describes periodic maintenance that is required for your Google Distributed Cloud clusters.

Rotate certificate authorities

The certificate authorities (CAs) in a cluster are valid for ten years. For versions before 1.36.100, the core cluster component clientconfig-operator, uses a certificate that is valid for five years and is only renewed when you rotate the cluster CA. To prevent this certificate from expiring, you must rotate your CAs at least once every five years, even if you don't actively use external identity providers or GKE Identity Service.

Certificates for cluster components

Cluster components use certificates for authentication:

• Control plane and node components: Certificates for components including kube-apiserver, kube-controller-manager, kube-scheduler, etcd, and kubelet are valid for one year and are renewed during cluster upgrade. To prevent these certificates from expiring, you must upgrade your cluster at least once a year.

• GKE Identity Service (clientconfig-operator): The certificate for the clientconfig-operator component is valid for ten years and is renewed when you rotate certificate authorities.

If the cluster certificates have expired, they must be renewed manually. For more information, see Certificate expiration.