<p>I use <code>kubeadm token create --print-join-command --ttl 0</code> to generate a token and then run the generated join command on my worker node. This generates a csr viewable with <code>kubectl get csr</code>.</p>

<p>After 37 days (first time I checked again might be earlier) the CSR is no longer returned from the API. I couldn't find any information about the automatic deletion of CSRs or their lifetime.</p>

<p>Anyone got some information about this and if there is a way to prevent the deletion?</p>

Kim
<p>After I couldn't find anything in the documentation I looked at the source code and found the CSRCleanerController:
<a href="https://github.com/kubernetes/kubernetes/blob/29b09c7fb1a8d38ab9df4873553cc0b8d97aae95/pkg/controller/certificates/cleaner/cleaner.go" rel="nofollow noreferrer">https://github.com/kubernetes/kubernetes/blob/29b09c7fb1a8d38ab9df4873553cc0b8d97aae95/pkg/controller/certificates/cleaner/cleaner.go</a></p>

<p>In there it says:</p>

<blockquote>
  <p>CSRCleanerController is a controller that garbage collects old
  certificate signing requests (CSRs). Since there are mechanisms that
  automatically create CSRs, and mechanisms that automatically approve
  CSRs, in order to prevent a build up of CSRs over time, it is
  necessary to GC them.</p>
  
  <p>CSRs will be removed if they meet one of the
  following criteria:</p>
  
  <ul>
  <li>the CSR is Approved with a certificate and is old enough to be past the GC issued deadline</li>
  <li>the CSR is denied and is old enough to be past the GC denied deadline</li>
  <li>the CSR is Pending and is old enough to be past the GC pending deadline, the CSR is approved with a certificate and the certificate is expired.</li>
  </ul>
</blockquote>

<p>The times are not configurable and are:</p>

<ul>
<li>remove approved after 1 hour</li>
<li>remove denied after 1 hour</li>
<li>remove pending after 24 hours</li>
</ul>
