How to update k8s certificate:
Some certificates in the k8s cluster are currently expired, prompting:
Unable to connect to the server: x509: certificate has expired or is not yet valid. Take a look at the online cluster master.
The ca.crt and front-proxy-ca.crt are not expired, but the front-proxy-client.crt, apiserver-kubelet-client.crt, and apiserver.crt are expired.
So manually passing the existing ca.key generates the apiserver.crt on the masterRefer to here. However, new errors occurred, suggesting:
the server has asked for the client to provide credentials
What is the way to update the certificate of k8s cluster?
thanks!
The latest kubeadm should have support for this.
Expected commands:
renew all
renew apiserver
renew apiserver-kubelet-client
renew apiserver-etcd-client
renew front-proxy-client
renew etcd-server
renew etcd-peer
renew etcd-healthcheck-clientYou generally have to review all the certs above, you can also renew them manually using openssl or cfssl and using the CA in /etc/kubernetes/pki/ca.pem