✨Add events for automatic certificate rotation in KubeadmControlPlane by VijetaPriya47 · Pull Request #13242 · kubernetes-sigs/cluster-api

VijetaPriya47 · 2026-01-18T10:54:54Z

This commit implements event generation for automatic certificate-related actions in KubeadmControlPlane to improve observability and monitoring.

Events added:

Kubeconfig certificate rotation - Emits events when kubeconfig client certificates are automatically rotated due to approaching expiry
Certificate-expiry-triggered rollouts - Emits double-sided events (on both Machine and KCP) when machines are rolled out due to certificate expiry

Event pattern:
Following the double-sided event pattern from PR #12930:

Events on affected objects (Machines) explain why they're being impacted
Events on controller objects (KCP) explain what the controller is doing

This improves observability by allowing operators to:

See certificate rotation actions in kubectl get events
Set up monitoring/alerting on certificate-related events
Understand why machines are being rolled out

Which issue(s) this PR fixes

Fixes #11944 (partially - certificate rotation portion)

Note: This PR addresses certificate rotation in KubeadmControlPlane. PR #12930 addresses MachineHealthCheck events.

k8s-ci-robot · 2026-01-18T10:55:05Z

This PR is currently missing an area label, which is used to identify the modified component when generating release notes.

Area labels can be added by org members by writing /area ${COMPONENT} in a comment

Please see the labels list for possible areas.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot · 2026-01-18T10:55:05Z

Hi @VijetaPriya47. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot · 2026-01-18T10:55:17Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign justinsb for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

VijetaPriya47 · 2026-01-18T10:57:31Z

@g-gaston @sivchari @fabriziopandini Could you review this please?

This commit adds event constant definitions that will be used to emit events for automatic certificate-related actions in KubeadmControlPlane: - EventKubeconfigCertificateRotated: Emitted when kubeconfig certificate is automatically rotated due to approaching expiry - EventKubeconfigCertificateRotationFailed: Emitted when kubeconfig certificate rotation fails - EventCertificateExpiryTriggeredRollout: Emitted when a machine is marked for rollout due to certificate expiry approaching the threshold These constants provide a foundation for improved observability and monitoring of automatic certificate management operations.

This commit implements event generation for automatic kubeconfig certificate rotation to improve observability and monitoring. Changes: - Add klog/v2 import for event message formatting - Emit EventKubeconfigCertificateRotated (Normal) when kubeconfig certificate is successfully rotated due to approaching expiry - Emit EventKubeconfigCertificateRotationFailed (Warning) when rotation fails These events help administrators monitor automatic certificate management and quickly identify any rotation failures that require attention.

This commit implements event generation when machines are rolled out due to certificate expiry approaching the configured threshold. Changes: - Emit double-sided events following the established pattern: * Event on Machine (Warning): Notifies the machine why it's being rolled out * Event on KCP (Normal): Notifies the administrator what the controller is doing - Events are only emitted when rollout is specifically due to certificate expiry (detected by checking for "certificates will expire soon" or "rolloutBefore expired" in the rollout log messages) This improves observability by making it clear when automatic rollouts are triggered by certificate expiry, helping administrators understand and monitor certificate lifecycle management.

controlplane/kubeadm/internal/controllers/helpers.go

controlplane/kubeadm/internal/controllers/controller.go

Address mentor feedback by: - Moving kubeconfig rotation success event after RegenerateSecret to prevent publishing success on failure - Defining CertificateExpiryRolloutLogMessage in internal/filters.go to avoid hardcoded string matching between filters.go and controller.go

VijetaPriya47 · 2026-02-20T10:07:41Z

@sivchari could you review again. I;ve resolved all the changes.

sivchari · 2026-03-10T08:55:43Z

controlplane/kubeadm/internal/controllers/controller.go

+			isCertExpiryRollout := false
+			for _, msg := range upToDateResult.LogMessages {
+				if strings.Contains(msg, internal.CertificateExpiryRolloutLogMessage) {
+					isCertExpiryRollout = true
+					break
+				}
+			}


isCertExpiryRollout := slices.ContainsFunc(upToDateResult.LogMessages, func(msg string) bool { return strings.Contains(msg, internal.CertificateExpiryRolloutLogMessage) })

It's simpler.

@sivchari could you review again? :)

linux-foundation-easycla · 2026-03-10T11:50:06Z

The committers listed above are authorized under a signed CLA.

✅ login: VijetaPriya47 / name: Vijeta Priya (36720a6, b71ef7c, c5cef6a, ce8546b, eeb14ea)

sivchari · 2026-03-11T05:43:54Z

/lgtm

@sbueringer @fabriziopandini
Please take a look when you have time.
If we decide to merge this PR, I think we also check #12930 .

k8s-ci-robot · 2026-03-11T05:44:04Z

LGTM label has been added.

Details

Git tree hash: 6744e591dc05174b9a7a1462f88298ada46d6a5a

k8s-ci-robot requested review from g-gaston and sivchari January 18, 2026 10:55

VijetaPriya47 mentioned this pull request Feb 13, 2026

✨Add event constants for certificate-related automatic actions #13337

Closed

VijetaPriya47 added 3 commits February 13, 2026 21:56

sivchari reviewed Feb 18, 2026

View reviewed changes

controlplane/kubeadm/internal/controllers/helpers.go Outdated Show resolved Hide resolved

controlplane/kubeadm/internal/controllers/controller.go Outdated Show resolved Hide resolved

VijetaPriya47 force-pushed the feature/add-events-for-automatic-actions branch from 5010584 to c5cef6a Compare February 20, 2026 10:04

sivchari reviewed Mar 10, 2026

View reviewed changes

k8s-ci-robot added cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. and removed cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Mar 10, 2026

Refactor certificate expiry rollout check to use slices.ContainsFunc

b71ef7c

VijetaPriya47 force-pushed the feature/add-events-for-automatic-actions branch from f1922a1 to b71ef7c Compare March 10, 2026 11:57

k8s-ci-robot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. and removed cncf-cla: no Indicates the PR's author has not signed the CNCF CLA. labels Mar 10, 2026

k8s-ci-robot assigned sivchari Mar 11, 2026

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 11, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

✨Add events for automatic certificate rotation in KubeadmControlPlane#13242

✨Add events for automatic certificate rotation in KubeadmControlPlane#13242
VijetaPriya47 wants to merge 5 commits intokubernetes-sigs:mainfrom
VijetaPriya47:feature/add-events-for-automatic-actions

VijetaPriya47 commented Jan 18, 2026 •

edited

Loading

Uh oh!

k8s-ci-robot commented Jan 18, 2026

Uh oh!

k8s-ci-robot commented Jan 18, 2026

Uh oh!

k8s-ci-robot commented Jan 18, 2026

Uh oh!

VijetaPriya47 commented Jan 18, 2026

Uh oh!

Uh oh!

Uh oh!

VijetaPriya47 commented Feb 20, 2026

Uh oh!

sivchari Mar 10, 2026

Uh oh!

VijetaPriya47 Mar 10, 2026

Uh oh!

linux-foundation-easycla bot commented Mar 10, 2026 •

edited

Loading

Uh oh!

sivchari commented Mar 11, 2026

Uh oh!

k8s-ci-robot commented Mar 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

VijetaPriya47 commented Jan 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Which issue(s) this PR fixes

Uh oh!

k8s-ci-robot commented Jan 18, 2026

Uh oh!

k8s-ci-robot commented Jan 18, 2026

Uh oh!

k8s-ci-robot commented Jan 18, 2026

Uh oh!

VijetaPriya47 commented Jan 18, 2026

Uh oh!

Uh oh!

Uh oh!

VijetaPriya47 commented Feb 20, 2026

Uh oh!

sivchari Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

VijetaPriya47 Mar 10, 2026

Choose a reason for hiding this comment

Uh oh!

linux-foundation-easycla bot commented Mar 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

sivchari commented Mar 11, 2026

Uh oh!

k8s-ci-robot commented Mar 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

VijetaPriya47 commented Jan 18, 2026 •

edited

Loading

linux-foundation-easycla bot commented Mar 10, 2026 •

edited

Loading