<p>We are receiving below alert in opsgenie, So please suggest how to do basic checks and fixing the issue</p>

<pre><code>Labels
alertname = KubeClientCertificateExpiration
cluster = cluster.example.com
job = apiserver
prometheus = openshift-monitoring/k8s
severity = warning
Annotations
message = Kubernetes API certificate is expiring in less than 7 days.
</code></pre>

<p>Thanks in advance </p>

<p>Ravi kumar G</p>

Ravikumar G
<p>This could be because Kubernetes API Server Client certificate is expiring. This is the certificate that Kubernetes API Server uses to talk to kubelet.</p>

<p>You could verify this by capturing network traffic on the kubelet https port using tcpdump and analyzing the tcp handshakes using wireshark (filter "tls.handshake.client_cert_vrfy.sig") and inspecting the client certificates.</p>

<p>Also check if there is any pending csr by <code>kubectl get csr --sort-by='{.metadata.creationTimestamp}</code>' and approve them using <code>kubectl certificate approve csrname</code></p>
