<p>I have an old kubernetes cluster on v1.8.6, using kOps I have been trying to upgrade the server to v1.20.8.</p>
<p>I run into a CA cert/key issue where kOps was failing to rolling update the cluster returning an error <code>x509: certificate signed by unknown authority</code>.</p>
<p>kOps had created a new ca secret, so there were now two secrets with type <code>ca</code>. Looking through github issues I found what sounds similar to what I was experiencing and I removed the old ca cert/key with <code>kOps delete secret ....</code> thinking I would move forward with the new one only.</p>
<p>I didn't take a backup of the key, I did get a copy of the <code>crt</code> from S3 but also from my local <code>.kube/config</code> and the master servers <code>~/.kube/config</code> has the same certificate-authority-data. I can connect to the cluster again with tls via kubectl, but kOps is having issues. There are no ca .crt or .key files in my kOps state store on S3.</p>
<p>Can I restore the key file somehow?<br />
Can I create a kOps secret in this case without the key file, if I plan on upgrading the cluster anyway?</p>

<p>If you have not rotated the control plane/master nodes, you will find the certificates on there. The location for those files have changed over the years, but you should hopefully find them in <code>/srv/kubernetes/</code>.</p>
<p>Or you can restore them if you have enabled <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/Versioning.html" rel="nofollow noreferrer">S3 versioning</a>.</p>
<p>kOps will reprovision any lost secrets next time you run <code>kops update cluster --yes</code>. You can stick with the new certificates, but then be aware you are effectively doing <a href="https://kops.sigs.k8s.io/operations/rotate-secrets/#legacy-procedure" rel="nofollow noreferrer">a key rotation</a> and may want to follow the remaining steps mentioned in this document.</p>
