Renew kubernetes certificates
If you got error like this
kubectl get po
Unable to connect to the server: x509: certificate has expired or is not yet valid: current time 2023-08-04T19:58:43Z is after 2023-08-03T20:24:43Z
Login by ssh to kubernetes master node and check certs
kubeadm certs check-expiration
Renew certification
cp -Rf /etc/kubernetes/ ~
kubeadm certs renew all
Command output
[renew] Reading configuration from the cluster...
[renew] FYI: You can look at this config file with 'kubectl -n kube-system get cm kubeadm-config -o yaml'
[renew] Error reading configuration from the Cluster. Falling back to default configuration
certificate embedded in the kubeconfig file for the admin to use and for kubeadm itself renewed
certificate for serving the Kubernetes API renewed
certificate the apiserver uses to access etcd renewed
certificate for the API server to connect to kubelet renewed
certificate embedded in the kubeconfig file for the controller manager to use renewed
certificate for liveness probes to healthcheck etcd renewed
certificate for etcd nodes to communicate with each other renewed
certificate for serving etcd renewed
certificate for the front proxy client renewed
certificate embedded in the kubeconfig file for the scheduler manager to use renewed
Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.
Restart control plane pods
cd /etc/kubernetes/ && cp -R manifests manifests.copy && rm manifests/* && sleep 60 && cp manifests.copy/* manifests/ && rm -rf manifests.copy
Check again certificates expire
kubeadm certs check-expiration
Copy new config
cp /etc/kubernetes/admin.conf $HOME/.kube/config
chown $(id -u):$(id -g) $HOME/.kube/config
Done
Troubleshooting
error
Error from server: error dialing backend: remote error: tls: internal error
fix
kubectl get csr --sort-by=.metadata.creationTimestamp
kubectl certificate approve csr-<****>