<p>I'm using kubeadm to build k8s cluster and default ssl certs will be used in 1 year.
I plan use cfssl or opensll to gen new certs with 10 years use.
Could anynone pls help me.</p>

<p>Thanks all</p>

Thanhvanptit
<p>To renew Kubernetes certs for 10 years (not recommended).
<img src="https://i.stack.imgur.com/9FSfj.png" alt="" /></p>
<ul>
<li><p>Check certs expiration</p>
<p><code>kubeadm alpha certs check-expiration --config=&quot;/etc/kubernetes/kubeadm-config.yaml&quot;</code></p>
</li>
<li><p>Back up the existing Kubernetes certificates</p>
<p><code>mkdir -p $HOME/fcik8s-old-certs/pki</code></p>
<p><code>/bin/cp -p /etc/kubernetes/pki/*.* $HOME/fcik8s-old-certs/pki</code></p>
</li>
<li><p>Back up the existing configurtion files</p>
<p><code>/bin/cp -p /etc/kubernetes/*.conf $HOME/fcik8s-old-certs</code></p>
</li>
<li><p>Back up your home configuration</p>
<p><code>mkdir -p $HOME/fcik8s-old-certs/.kube</code></p>
<p><code>/bin/cp -p ~/.kube/config $HOME/fcik8s-old-certs/.kube/.</code></p>
</li>
<li><p>Add <em>--cluster-signing-duration</em> flag (<em>--experimental-cluster-signing-duration</em> prior to 1.19) for <em>kube-controller-manager</em></p>
<blockquote>
<p>Edit /etc/kubernetes/manifests/kube-controller-manager.yaml</p>
</blockquote>
<pre><code> apiVersion: v1
 kind: Pod
 metadata:
   creationTimestamp: null
   labels:
     component: kube-controller-manager
     tier: control-plane
   name: kube-controller-manager
   namespace: kube-system
 spec:
   containers:
   - command:
     - kube-controller-manager
     ...
     - --experimental-cluster-signing-duration=87600h
     ...
 ...
</code></pre>
<p>87600h ~ 10 years</p>
</li>
<li><p>Renew all certs</p>
<p><code>kubeadm alpha certs renew all --config /etc/kubernetes/kubeadm-config.yaml --use-api</code></p>
</li>
<li><p>Approve the cert request</p>
<p><code>kubectl get csr</code></p>
<p><code>kubectl certificate approve &lt;cert_request&gt;</code></p>
</li>
<li><p>Update the kubeconfig file</p>
<p><code>kubeadm init phase kubeconfig all --config /etc/kubernetes/kubeadm-config.yaml</code></p>
</li>
<li><p>Overwrite the original admin file with the newly generated admin configuration file</p>
<p><code>cp -i /etc/kubernetes/admin.conf $HOME/.kube/config</code></p>
<p><code>chown $(id -u):$(id -g) $HOME/.kube/config</code></p>
</li>
<li><p>Restart components</p>
<p><code>docker restart $(docker ps | grep etcd  | awk '{ print $1 }')</code></p>
<p><code>docker restart $(docker ps | grep kube-apiserver  | awk '{ print $1 }')</code></p>
<p><code>docker restart $(docker ps | grep kube-scheduler  | awk '{ print $1 })</code></p>
<p><code>docker restart $(docker ps | grep kube-controller  | awk '{ print $1 }')</code></p>
<p><code>systemctl daemon-reload &amp;&amp; systemctl restart kubelet</code></p>
</li>
<li><p>Check api-server cert expiration</p>
<p><code>echo | openssl s_client -showcerts -connect 127.0.0.1:6443 -servername api 2&gt;/dev/null | openssl x509 -noout -enddate</code></p>
</li>
</ul>
