title: Kubernetes Kube-API certificate expire log
body: <p>Recently the certificates of the Kubernetes cluster have been upgraded. This is an external ETCD managed cluster. Renewed the Master nodes and Worker nodes via Kubeadm upgrade. The external ETCD nodes were upgrade via Kubeadm certs renewal. Afterwards copied the apiserver-etcd-client.crt apiserver-etcd-client.key to the control nodes</p>
  <p>ETCD cert check :</p>
  <pre><code>CERTIFICATE                          EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
  !MISSING! admin.conf
  !MISSING! apiserver
  apiserver-etcd-client                Oct 11, 2022 20:18 UTC   341d            etcd-ca                 no
  !MISSING! apiserver-kubelet-client
  !MISSING! controller-manager.conf
  etcd-healthcheck-client              Oct 11, 2022 20:29 UTC   341d            etcd-ca                 no
  etcd-peer                            Oct 11, 2022 20:29 UTC   341d            etcd-ca                 no
  etcd-server                          Oct 11, 2022 20:29 UTC   341d            etcd-ca                 no
  !MISSING! front-proxy-client
  !MISSING! scheduler.conf
  
  CERTIFICATE AUTHORITY      EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
  !MISSING! ca
  etcd-ca                    Oct 25, 2029 18:05 UTC   7y              no
  </code></pre>
  <p>Control Plane cert check :</p>
  <pre><code>CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGED
  admin.conf                 Oct 11, 2022 20:07 UTC   341d                                    no
  apiserver                  Oct 11, 2022 20:07 UTC   341d            ca                      no
  apiserver-kubelet-client   Oct 11, 2022 20:07 UTC   341d            ca                      no
  controller-manager.conf    Oct 11, 2022 20:07 UTC   341d                                    no
  front-proxy-client         Oct 11, 2022 20:07 UTC   341d            front-proxy-ca          no
  scheduler.conf             Oct 11, 2022 20:07 UTC   341d                                    no
  
  CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGED
  ca                      Oct 25, 2029 19:27 UTC   7y              no
  front-proxy-ca          Oct 25, 2029 19:27 UTC   7y              no
  </code></pre>
  <p>But all the Kube-API pods on the control nodes generates the following error log. Currently there are no effect to the cluster admin (kubectl commands, scheduling and etc.)</p>
  <pre><code>{&quot;log&quot;:&quot;E1104 03:25:02.294264       1 authentication.go:53] Unable to authenticate the request due to an error: x509: certificate has expired or is notyet valid\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2021-11-04T03:25:02.294433099Z&quot;}
  {&quot;log&quot;:&quot;E1104 03:25:02.312771       1 authentication.go:53] Unable to authenticate the request due to an error: x509: certificate has expired or is notyet valid\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2021-11-04T03:25:02.312993805Z&quot;}
  {&quot;log&quot;:&quot;E1104 03:25:02.332196       1 authentication.go:53] Unable to authenticate the request due to an error: x509: certificate has expired or is notyet valid\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2021-11-04T03:25:02.332386139Z&quot;}
  {&quot;log&quot;:&quot;E1104 03:25:02.343118       1 authentication.go:53] Unable to authenticate the request due to an error: x509: certificate has expired or is notyet valid\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2021-11-04T03:25:02.343341123Z&quot;}
  {&quot;log&quot;:&quot;E1104 03:25:02.351442       1 authentication.go:53] Unable to authenticate the request due to an error: x509: certificate has expired or is notyet valid\n&quot;,&quot;stream&quot;:&quot;stderr&quot;,&quot;time&quot;:&quot;2021-11-04T03:25:02.351630063Z&quot;}
  </code></pre>
  <p>Restarted the Kube-API from docker container and checked for any abnormalities on the kube-metrics server and other monitoring services. Yet no traces found</p>
  <p>What could be the reason the Kube-API generates such an error?</p>