<p>How to update k8s certificate:</p>

<p>Some certificates in the k8s cluster are currently expired, prompting: </p>

<blockquote>
  <p>Unable to connect to the server: x509: certificate has expired or is
  not yet valid. Take a look at the online cluster master.</p>
</blockquote>

<p>The <code>ca.crt</code> and <code>front-proxy-ca.crt</code> are not expired, but the <code>front-proxy-client.crt</code>, <code>apiserver-kubelet-client.crt</code>, and <code>apiserver.crt</code> are expired.</p>

<p>So manually passing the existing <code>ca.key</code> generates the <code>apiserver.crt</code> on the master<a href="https://stackoverflow.com/questions/49885636/kubernetes-expired-certificate">Refer to here</a>. However, new errors occurred, suggesting: </p>

<blockquote>
  <p>the server has asked for the client to provide credentials</p>
</blockquote>

<p>What is the way to update the certificate of k8s cluster?</p>

<p>thanks!</p>

zhaoyi
<p>The latest kubeadm should have support for <a href="https://github.com/kubernetes/kubernetes/pull/67910" rel="nofollow noreferrer">this</a>.</p>

<p>Expected commands:</p>

<pre><code>renew all
renew apiserver
renew apiserver-kubelet-client
renew apiserver-etcd-client
renew front-proxy-client
renew etcd-server
renew etcd-peer
renew etcd-healthcheck-client
</code></pre>

<p>You generally have to review all the certs above, you can also renew them manually using <a href="https://www.openssl.org/" rel="nofollow noreferrer">openssl</a> or <a href="https://github.com/cloudflare/cfssl" rel="nofollow noreferrer">cfssl</a> and using the CA in <code>/etc/kubernetes/pki/ca.pem</code></p>
