<p>Team,</p>

<p>I already have a cluster running and I need to update the OIDC value. is there a way I can do it without having to recreate the cluster?</p>

<p>ex: below is my cluster info and I need to update the <code>oidcClientID: spn:</code> </p>

<p>How can I do this as I have 5 masters running?</p>

<pre><code>kubeAPIServer:
    storageBackend: etcd3
    oidcClientID: spn:45645hhh-f641-498d-b11a-1321231231
    oidcUsernameClaim: upn
    oidcUsernamePrefix: "oidc:"
    oidcGroupsClaim: groups
    oidcGroupsPrefix: "oidc:"
</code></pre>

<p>You update your kube-apiserver on your masters one by one (update/restart). If your cluster is setup correctly, when you get to the active kube-apiserver it should automatically failover to another kube-apiserver master in standby. </p>

<p>You can add the oidc options in the <code>/etc/kubernetes/manifests/kube-apiserver.yaml</code> pod manifest file.</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  annotations:
    scheduler.alpha.kubernetes.io/critical-pod: ""
  creationTimestamp: null
  labels:
    component: kube-apiserver
    tier: control-plane
  name: kube-apiserver
  namespace: kube-system
spec:
  containers:
  - command:
    - kube-apiserver
    - --authorization-mode=Node,RBAC
    - --advertise-address=172.x.x.x
    - --allow-privileged=true
    - --client-ca-file=/etc/kubernetes/pki/ca.crt
    - --oidc-client-id=...
    - --oidc-username-claim=...
    - --oidc-username-prefix=...
    - --oidc-groups-claim=...
    - --oidc-groups-prefix=...
...
</code></pre>

<p>Then you can restart your <code>kube-apiserver</code> container, if you are using docker:</p>

<pre><code>$ sudo docker restart &lt;container-id-for-kube-apiserver&gt;
</code></pre>

<p>Or if you'd like to restart all the components on the master:</p>

<pre><code>$ sudo systemctl restart docker
</code></pre>

<p>Watch for logs on the kube-apiserver container</p>

<pre><code>$ sudo docker logs -f &lt;container-id-for-kube-apiserver&gt;
</code></pre>

<p>Make sure you never have less running nodes than your <a href="https://blogs.msdn.microsoft.com/clustering/2011/05/27/understanding-quorum-in-a-failover-cluster/" rel="nofollow noreferrer">quorum</a> which should be 3 for your 5 master cluster, to be safe. If for some reason your etcd cluster falls out of quorum you will have to recover by recreating the etcd cluster and <a href="https://kubernetes.io/docs/tasks/administer-cluster/configure-upgrade-etcd/#restoring-an-etcd-cluster" rel="nofollow noreferrer">restoring</a> from a backup. </p>
