<p>I did a</p>
<pre><code>kubeadm alpha certs renew
</code></pre>
<p>but after that, no pods get started. When starting from a Deployment, <code>kubectl get pod</code> doesn't even list the pod, when explicitly starting a pod, it is stuck on <code>Pending</code>.</p>
<p>What am I missing?</p>

<p>Normally I would follow a pattern to debug such issues starting with:</p>
<ol>
<li>Check all the certificate files are rotated by <code>kubeadm</code> using <code>sudo cat /etc/kubernetes/ssl/apiserver.crt | openssl x509 -text</code>.</li>
<li>Make sure all the control plane services (<code>api-server</code>, <code>controller</code>, <code>scheduler</code> etc) have been restarted to use the new certificates.</li>
<li>If [1] and [2] are okay you should be able to do <code>kubectl get pods</code></li>
<li>Now you should check the certificates for kubelet and make sure you are not hitting <a href="https://github.com/kubernetes/kubeadm/issues/1753" rel="nofollow noreferrer">https://github.com/kubernetes/kubeadm/issues/1753</a></li>
<li>Make sure <code>kubelet</code> is restarted to use the new certificate.</li>
</ol>
<p>I think of control plane (not being able to do <code>kubectl</code>) and <code>kubelet</code> (node status not ready, should see certificates attempts in <code>api-server</code> logs from the node) certificates expiry separately so I can quickly tell which might be broken.</p>
