Your Kubernetes cluster's TLS certificates for the API server, kubelet, and etcd are expiring in 48 hours. The cluster was bootstrapped with kubeadm. Walk through the complete renewal process and what happens if certificates actually expire.
Quick Answer
Use 'kubeadm certs renew all' to renew certificates, then restart control plane static pods. If certificates expire, the API server becomes unreachable, kubelet can't communicate with the control plane, and etcd peer communication fails, effectively freezing the cluster.
Detailed Answer
Certificate Architecture in kubeadm Clusters
kubeadm creates a PKI with a self-signed root CA (valid 10 years) and multiple leaf certificates (valid 1 year by default): - apiserver.crt: API server serving cert (SAN includes ClusterIP, node IPs, DNS names) - apiserver-kubelet-client.crt: API server -> kubelet authentication - apiserver-etcd-client.crt: API server -> etcd client cert - etcd/server.crt, etcd/peer.crt: etcd serving and peer certs - front-proxy-client.crt: For API aggregation layer - Kubelet client/server certificates (auto-rotated via CSR if configured)
Renewal Process
1. Check expiration: kubeadm certs check-expiration 2. Renew all: kubeadm certs renew all (uses existing CA to sign new certs) 3. Restart static pods: Move manifests out of /etc/kubernetes/manifests/ and back (or crictl to restart containers) 4. Update kubeconfig files: kubeadm kubeconfig user --client-name=admin to regenerate admin.conf 5. Distribute updated kubeconfigs to all control plane nodes
What Happens When Certificates Expire
- API server returns TLS handshake errors - kubectl commands fail with x509: certificate has expired - kubelet can't report node status - nodes show NotReady after node-monitor-grace-period (40s default) - etcd peer communication fails if peer certs expire - etcd cluster loses quorum, all writes fail - Webhooks and admission controllers fail - no new pods can be scheduled - Service mesh control planes (Istio) lose connection to API server
Emergency Recovery (After Expiry)
You can still renew certs because kubeadm certs renew reads the CA from disk, not from the API server. However, you must manually restart kubelet and static pod containers. If etcd peer certs expired, you may need to restart etcd members one at a time.