How to Renew Kubernetes Certificates

By default, Kubernetes certificates need to be renewed once a year. Below is a record of one certificate renewal process.

1. Check the Certificates

Check the certificate expiration time on a master node:

1
kubeadm certs check-expiration

On older cluster versions this command errors out; use: kubeadm alpha certs check-expiration

2. Back Up the Relevant Files

The simplest approach is to back up the entire Kubernetes configuration directory.

1
cp -r /etc/kubernetes /etc/kubernetes.old

3. Run the Renewal Command on Every Master Node

1
kubeadm certs renew all

On older cluster versions this command errors out; use: kubeadm alpha certs renew all

4. Update the ~/.kube/config File

Docker

1
2
3
4
5
6
cat > kubeadm.yaml <<EOF
apiVersion: kubeadm.k8s.io/v1beta3
kind: InitConfiguration
nodeRegistration:
  criSocket: unix:///var/run/cri-dockerd.sock
EOF

1
kubeadm init phase kubeconfig all --config kubeadm.yaml

Containerd

1
kubeadm init phase kubeconfig all

Update the kubeconfig files for all consumers

1
2
cp -f /etc/kubernetes/admin.conf $HOME/.kube/config
chown $(id -u):$(id -g) $HOME/.kube/config

Check the certificate validity in the kubeconfig file

1
2
3
4
KUBECONFIG=~/.kube/config \
kubectl config view --raw -o jsonpath='{.users[0].user.client-certificate-data}' \
| base64 -d \
| openssl x509 -noout -dates

5. Restart the Relevant Services

Restart kubelet

1
systemctl restart kubelet

Restart the cluster components

1
nerdctl -n k8s.io ps | egrep "kube-apiserver|kube-scheduler|kube-controller-manager|etcd" | awk '{print $1}' | xargs -r -n1 -P0 nerdctl -n k8s.io restart || true

Check component status

1
nerdctl -n k8s.io ps | egrep "kube-apiserver|kube-scheduler|kube-controller-manager|etcd"

6. Check the Certificate Validity in the Configuration Files

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
for f in /etc/kubernetes/*.conf; do
  echo "=== $f ==="
  cert=$(grep 'client-certificate-data:' "$f" | awk '{print $2}')
  if [ -n "$cert" ]; then
    echo "$cert" | base64 --decode | openssl x509 -noout -dates
  else
    echo "No client certificate found"
  fi
  echo
done