:_mod-docs-content-type: ASSEMBLY
[id="cert-types-bootstrap-certificates"]
= Bootstrap certificates
include::_attributes/common-attributes.adoc[]
:context: cert-types-bootstrap-certificates

toc::[]

[role="_abstract"]
You should understand how bootstrap certificates enable kubelet transport layer security (TLS) bootstrapping when nodes join a cluster, including how the certificates are issued and rotated and how the certificates are managed.

[id="bootstrap-certificates-purpose_{context}"]
== Purpose

The kubelet, in {product-title} 4 and later, uses the bootstrap certificate located in `/etc/kubernetes/kubeconfig` to initially bootstrap. This is followed by the bootstrap initialization process and the authorization of the kubelet to create a certificate signing request (CSR).

In that process, the kubelet generates a CSR while communicating over the bootstrap channel. The controller manager signs the CSR, resulting in a certificate that the kubelet manages. For more information, see "Bootstrap initialization" and "Authorize kubelet to create a CSR" in the _Additional resources_ section.

[id="bootstrap-certificates-management_{context}"]
== Management

These certificates are managed by the system and not the user.

[id="bootstrap-certificates-expiration_{context}"]
== Expiration

This bootstrap certificate is valid for 10 years.

The kubelet-managed certificate is valid for one year and rotates automatically at around the 80 percent mark of that one year.

[NOTE]
====
OpenShift Lifecycle Manager (OLM) does not update the bootstrap certificate.
====

[id="bootstrap-certificates-customization_{context}"]
== Customization

You cannot customize the bootstrap certificates.

[role="_additional-resources"]
.Additional resources

* link:https://kubernetes.io/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/#bootstrap-initialization[Bootstrap initialization]
* link:https://kubernetes.io/docs/reference/access-authn-authz/kubelet-tls-bootstrapping/#authorize-kubelet-to-create-csr[Authorize kubelet to create a CSR]