Configuration·Certified Kubernetes Administrator
Renewing Cluster Certificates
kubeadm certs renew all rewrites eleven certificates and tells you to restart four components. The apiserver's serving certificate reloads on its own - same container, ATTEMPT 0 - and the restart is for everything else.
Cluster Architecture and Configuration Guide 23 of 103 Advanced
- Kubernetes1.36.4
- Cluster2 nodes
- Runtimecontainerd 2.2.6
- CNICalico v3.32.1
- TimeAbout 16 min
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA3001 | 192.168.0.185 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA3001-NODE01 | 192.168.0.186 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
This guide includes
Use this before a cluster's certificates expire, or in a hurry once they already have. This matters because kubeadm signs a stack of certificates with a one-year life, and renewing them is not finished until the control plane components have actually restarted.
- taking the full inventory with
kubeadm certs check-expiration - reading the CA's own subject and validity, which runs on a different clock
- renewing everything with
certs renew alland reading the last line rather than the scroll - restarting a static-pod control plane by moving its manifests out and back
- confirming the served certificate actually changed with
openssl s_client
Before you start
- guide 96 is the failure this prevents - worth reading first, because it is what the deadline looks like when you miss it.
sudoon the control plane. Every command here is privileged.
-
Find out what expires and when
-
Renew, and read the last line
-
Restart the control plane by moving a file