<p>I'm using kubeadm to build k8s cluster and default ssl certs will be used in 1 year.
I plan use cfssl or opensll to gen new certs with 10 years use.
Could anynone pls help me.</p>

<p>Thanks all</p>

Thanhvanptit
<p>You can generate certs using cfssl or openssl and store in a directory and specify that directory in Kubeadm init and kubeadm will not generate certs and use the provided certs.</p>

<pre><code>kubeadm init --cert-dir
</code></pre>

<p><a href="https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#custom-certificates" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#custom-certificates</a></p>

<p>Kubeadm also provides cert renew mechanism for renewing certs for 1 year.</p>

<pre><code>kubeadm alpha certs renew
</code></pre>

<p>Since you have a running cluster which signs certs with 1 year of validity you can change this flag of kube controller manager default duration of cert signed to sign certs for 10 years.</p>

<pre><code>--experimental-cluster-signing-duration duration     Default: 8760h0m0s 
</code></pre>

<p>Once this is done you can use below guide to sign cert valid for 10 years.</p>

<p><a href="https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#renew-certificates-with-the-kubernetes-certificates-api" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/#renew-certificates-with-the-kubernetes-certificates-api</a></p>
