Skip to content

✨Add events for automatic certificate rotation in KubeadmControlPlane#13242

Open
VijetaPriya47 wants to merge 2 commits intokubernetes-sigs:mainfrom
VijetaPriya47:feature/add-events-for-automatic-actions
Open

✨Add events for automatic certificate rotation in KubeadmControlPlane#13242
VijetaPriya47 wants to merge 2 commits intokubernetes-sigs:mainfrom
VijetaPriya47:feature/add-events-for-automatic-actions

Conversation

@VijetaPriya47
Copy link
Contributor

@VijetaPriya47 VijetaPriya47 commented Jan 18, 2026 •
edited
Loading

This commit implements event generation for automatic certificate-related actions in KubeadmControlPlane to improve observability and monitoring.

Events added:

  1. Kubeconfig certificate rotation - Emits events when kubeconfig client certificates are automatically rotated due to approaching expiry
  2. Certificate-expiry-triggered rollouts - Emits double-sided events (on both Machine and KCP) when machines are rolled out due to certificate expiry

Event pattern:
Following the double-sided event pattern from PR #12930:

  • Events on affected objects (Machines) explain why they're being impacted
  • Events on controller objects (KCP) explain what the controller is doing

This improves observability by allowing operators to:

  • See certificate rotation actions in kubectl get events
  • Set up monitoring/alerting on certificate-related events
  • Understand why machines are being rolled out

Which issue(s) this PR fixes

Fixes #11944 (partially - certificate rotation portion)

Note: This PR addresses certificate rotation in KubeadmControlPlane. PR #12930 addresses MachineHealthCheck events.

@VijetaPriya47
This commit implements event generation for automatic certificate-rel…
cc00cce 
…ated

actions in KubeadmControlPlane to improve observability and monitoring.

Changes:
1. Added event constants for certificate rotation events
2. Emit events when kubeconfig certificates are automatically rotated
3. Emit double-sided events (on both Machine and KCP) when machines are
   rolled out due to certificate expiry
@k8s-ci-robot k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/needs-area PR is missing an area label size/M Denotes a PR that changes 30-99 lines, ignoring generated files. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jan 18, 2026
@k8s-ci-robot
Copy link
Contributor

k8s-ci-robot commented Jan 18, 2026

This PR is currently missing an area label, which is used to identify the modified component when generating release notes.

Area labels can be added by org members by writing /area ${COMPONENT} in a comment

Please see the labels list for possible areas.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot
Copy link
Contributor

k8s-ci-robot commented Jan 18, 2026

Hi @VijetaPriya47. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot
Copy link
Contributor

k8s-ci-robot commented Jan 18, 2026

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign justinsb for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@VijetaPriya47
Copy link
Contributor Author

VijetaPriya47 commented Jan 18, 2026

@g-gaston @sivchari @fabriziopandini Could you review this please?

@VijetaPriya47 VijetaPriya47 mentioned this pull request Feb 13, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@g-gaston g-gaston Awaiting requested review from g-gaston

@sivchari sivchari Awaiting requested review from sivchari

Assignees

No one assigned

Labels

cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/needs-area PR is missing an area label needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Request for Events Generation for Automatic Changes in Cluster State

2 participants

@VijetaPriya47 @k8s-ci-robot