<p>I am trying to achieve that my kubernetes cluster should have a validity of 5 years, so I have made my <strong>ca.crt, apiserver.crt, kubelet-client.crt, front-proxy.crt</strong> of 5 years validity and placed those in <strong>/etc/kubernetes/pki</strong>.</p>

<p>Also, I have enabled my kubelet with client certificate rotation </p>

<pre><code>Environment="KUBELET_CERTIFICATE_ARGS=--rotate-certificates=true --cert-dir=/var/lib/kubelet/pki --feature-gates=RotateKubeletClientCertificate=true"
</code></pre>

<p>So to verify my cluster is working fine I changed the date on my system to 1 day before 1 year expiration and certificate rotation are done properly</p>

<pre><code>Oct 22 06:00:16 ip-10-0-1-170.ec2.internal kubelet[28887]: I1022 06:00:16.806115   28887 reconciler.go:154] Reconciler: start to sync state
Oct 22 06:00:23 ip-10-0-1-170.ec2.internal kubelet[28887]: I1022 06:00:23.546154   28887 transport.go:126] certificate rotation detected, shutting down client connections to start using new credentials
</code></pre>

<p>But once my cluster passes one year it starts showing the error on any kubectl get nodes/pods command:
"error: You must be logged in to the server (Unauthorized)"</p>

<p>The possible issue I can think is <strong>/etc/kubernetes/admin.conf</strong> has only one-year validity certificates. Thanks for your help </p>

Prafull Ladha
<p>Your <code>client-certificate</code>(<strong>/etc/kubernetes/admin.conf</strong>) is generated for one year. You can generate your client certificate using following command:</p>

<pre><code>kubeadm alpha phase kubeconfig admin --cert-dir /etc/kubernetes/pki --kubeconfig-dir /etc/kubernetes/
</code></pre>
