<p>I'm trying to follow this <a href="https://blog.inkubate.io/install-and-configure-a-multi-master-kubernetes-cluster-with-kubeadm/" rel="nofollow noreferrer">tutorial</a>.  </p>

<ol>
<li>What would be the advantage of generating the certs yourself instead of depending on kubeadm? </li>
<li>if you create the certs yourself, does the auto-rotation happens after setting up the cluster from kubeadm?</li>
</ol>

<p>Thanks!</p>

<ol>
<li><p>No major advantage. kubeadm does the same: generate self-signed certs. The only mini advantage is that you could add some custom values in the <a href="https://en.wikipedia.org/wiki/Certificate_signing_request" rel="nofollow noreferrer">CSR</a>, such as a City, Organization, etc.</p></li>
<li><p>Not really.</p>

<ul>
<li>There's a <a href="https://kubernetes.io/docs/tasks/tls/certificate-rotation/#enabling-client-certificate-rotation" rel="nofollow noreferrer">kubelet certificate</a> rotation flag <code>--rotate-certificates</code> that needs to be enabled.</li>
<li><p>There's also the certificate rotation from the masters and <code>kubeadm</code> can help with that with these <a href="https://stackoverflow.com/questions/46360361/invalid-x509-certificate-for-kubernetes-master?answertab=votes#tab-top">commands</a>:</p>

<pre><code>mkdir /etc/kubernetes/pkibak
mv /etc/kubernetes/pki/* /etc/kubernetes/pkibak
rm /etc/kubernetes/pki/*
kubeadm init phase certs all --apiserver-advertise-address=0.0.0.0 --apiserver-cert-extra-sans=x.x.x.x,x.x.x.x
systemctl restart docker
</code></pre></li>
</ul></li>
</ol>

<p>If you'd like to regenerate the <code>admin.conf</code> file, you can also use <code>kubeadm</code>:</p>

<pre><code>$ kubeadm init phase kubeconfig admin \
  --cert-dir /etc/kubernetes/pki \
  --kubeconfig-dir /tmp/.
</code></pre>
