<p>Today, my kubernetes(<code>v1.21</code>) cluster certificate was expired(1 year), after I using this command to renew the certificate:</p>
<pre><code>kubeadm certs renew all
</code></pre>
<p>the logs shows that the kube-apiserver\etcd should be restart:</p>
<pre><code>Done renewing certificates. You must restart the kube-apiserver, kube-controller-manager, kube-scheduler and etcd, so that they can use the new certificates.
</code></pre>
<p>I have tried this way to restart:</p>
<pre><code>[root@k8smasterone ~]# systemctl restart kube-apiserver
Failed to restart kube-apiserver.service: Unit not found.
</code></pre>
<p>what should I do to restart all the component's properly? I also tried to find the kubernetes pods that did not found pods with kubernetes with api server.</p>

<p>On 1.23.5 even after restarting <code>kubelet</code> through <code>systemctl restart kubelet</code> my <code>kube-controller-manager</code> still had errors (<code>kubectl -n kube-system logs kube-controller-manager-kubeadm</code> - name will vary according to your node name):</p>
<pre><code>error retrieving resource lock kube-system/kube-controller-manager: Unauthorized
</code></pre>
<p>Only after following <a href="https://v1-23.docs.kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/" rel="noreferrer">this documentation</a> I was able to fix:</p>
<pre class="lang-bash prettyprint-override"><code>mkdir tmp
mv /etc/kubernetes/manifests/* tmp/
# Wait until pods stop running (in my case, single master, kubectl stopped working)
mv tmp/* /etc/kubernetes/manifests/
</code></pre>
<p>Before running the commands above some pods worked, but my cluster was highly inconsistent: wrong endpoints for services, deleted pods from daemonsets would not restart, that is how I suspected the controller was not healthy.</p>
