<p>We want to be able to re-deploy our Kubernetes cluster at any time, for an emergency measure when everything is screwed up, or as an easy way to upgrade to a new Kubernetes version.  We do that from scratch; in particular, /etc/kubernetes is wiped out.  But this forces us to distribute new user certificates afterwards.  However, the current ones should remain valid.</p>

<p>How do we do that? Store some files in /etc/kubernetes (surely not all of them) and copy them back to the cluster?  If so, which files? And copy them back before or after the <code>kubeadm init</code> call?  Or is it better to use one of the certificate-related arguments to kubeadm?</p>

Torsten Bronger
<p>You can keep all certs in a different directory than the default directory <code>/etc/kubernetes/pki</code>.You do this before running <code>kubeadm init</code>.Now while running <code>kubeadm init</code> specify that directory by the <code>--cert-dir</code> flag or the certificatesDir field of kubeadm’s ClusterConfiguration.</p>

<p>Alternative option would be to skip the cert and config generation by specifying <code>--skip-phases=certs,kubeconfig</code> in <code>kubeadm init</code>.</p>

<p>At some point the certs will expire and you can then renew them <code>kubeadm alpha certs renew</code></p>

<p><a href="https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/</a></p>
