<p>I'm a novice k8s engineer.
Until now, I have managed the k8s certificate by manually renewing it once a year.</p>
<p>However, I became curious about how to set the certificates below for more than 1 year in the first place.</p>
<pre><code>[root@master ~]# kubeadm alpha certs check-expiration

CERTIFICATE                EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
admin.conf                 May 21, 2022 01:29 UTC   311d            no      
apiserver                  May 21, 2022 01:29 UTC   311d            no      
apiserver-etcd-client      May 21, 2022 01:29 UTC   311d            no      
apiserver-kubelet-client   May 21, 2022 01:29 UTC   311d            no      
controller-manager.conf    May 21, 2022 01:29 UTC   311d            no      
etcd-healthcheck-client    May 21, 2022 01:29 UTC   311d            no      
etcd-peer                  May 21, 2022 01:29 UTC   311d            no      
etcd-server                May 21, 2022 01:29 UTC   311d            no      
front-proxy-client         May 21, 2022 01:29 UTC   311d            no      
scheduler.conf             May 21, 2022 01:29 UTC   311d            no      
</code></pre>
<p>Can these certificates be extended by more than a year? (nearly 10 years..?)</p>
<p>k8s version is 1.16</p>
<p>I can use a private certificate. It doesn't matter which way.
(There is a limit to searching because I am not good at English.)</p>
<p>Please tell me how to renew the K8s certificate(api..) only once every 10 years!</p>

<p>It is not recommended to have the certificates for more than one year. Kubernetes provides hassle-free way to create and renew certs every one year.
<a href="https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/" rel="nofollow noreferrer">Kubernetes Certificates</a>
Since you need it for some special requirement:</p>
<ul>
<li>Check certs expiration</li>
<li>Back up the existing Kubernetes certificates. Backup all the certs in
the pki dir to somewhere safe and controlled access.</li>
<li>Backup the existing and necessary configurtion files</li>
<li>Add --cluster-signing-duration flag for kube-controller-manager. <a href="https://kubernetes.io/docs/tasks/tls/certificate-rotation/" rel="nofollow noreferrer">kubernetes doc for signing duration</a></li>
</ul>
<p>Edit /etc/kubernetes/manifests/kube-controller-manager.yaml</p>
<pre><code> apiVersion: v1
 kind: Pod
 metadata:
  ...
   name: kube-controller-manager
   namespace: kube-system
 spec:
   containers:
   - command:
     - kube-controller-manager
     ...
     - --experimental-cluster-signing-duration=87600h
     ...
 ...
</code></pre>
<p>87600h ~ 10 years</p>
<ul>
<li><p>Renew all certs kubeadm alpha certs renew all --config
/etc/kubernetes/kubeadm-config.yaml</p>
</li>
<li><p>Follow the CSR request and approve method.</p>
</li>
<li><p>Restart the necessary componenets like etcd, kube-apiserver, kube-scheduler , controller, kubelet</p>
</li>
<li><p>Check the new cert expiry</p>
</li>
</ul>
<p>Please follow this in the test lab scenario before doing on any prod envs while the clusters are running</p>
