Breaking News: Grepper is joining You.com. Read the official announcement!

kubeadm x509 certificate has expired or is not yet valid

DreamCoder answered on January 21, 2023 Popularity 6/10 Helpfulness 2/10

answer kubeadm x509 certificate has expired or is not yet valid

related kubeadm x509 certificate has expired or is not yet valid

kubeadm x509 certificate has expired or is not yet valid

Comment

check all certificate expire date:

find /etc/kubernetes/pki/ -type f -name "*.crt" -print|egrep -v 'ca.crt$'|xargs -L 1 -t  -i bash -c 'openssl x509  -noout -text -in {}|grep After'
Renew certificate on Master node.

*) Renew certificate

mv /etc/kubernetes/pki/apiserver.key /etc/kubernetes/pki/apiserver.key.old
mv /etc/kubernetes/pki/apiserver.crt /etc/kubernetes/pki/apiserver.crt.old
mv /etc/kubernetes/pki/apiserver-kubelet-client.crt /etc/kubernetes/pki/apiserver-kubelet-client.crt.old
mv /etc/kubernetes/pki/apiserver-kubelet-client.key /etc/kubernetes/pki/apiserver-kubelet-client.key.old
mv /etc/kubernetes/pki/front-proxy-client.crt /etc/kubernetes/pki/front-proxy-client.crt.old
mv /etc/kubernetes/pki/front-proxy-client.key /etc/kubernetes/pki/front-proxy-client.key.old


kubeadm alpha phase certs apiserver  --config /root/kubeadm-kubetest.yaml
kubeadm alpha phase certs apiserver-kubelet-client
kubeadm alpha phase certs front-proxy-client
 
mv /etc/kubernetes/pki/apiserver-etcd-client.crt /etc/kubernetes/pki/apiserver-etcd-client.crt.old
mv /etc/kubernetes/pki/apiserver-etcd-client.key /etc/kubernetes/pki/apiserver-etcd-client.key.old
kubeadm alpha phase certs  apiserver-etcd-client


mv /etc/kubernetes/pki/etcd/server.crt /etc/kubernetes/pki/etcd/server.crt.old
mv /etc/kubernetes/pki/etcd/server.key /etc/kubernetes/pki/etcd/server.key.old
kubeadm alpha phase certs  etcd-server --config /root/kubeadm-kubetest.yaml

mv /etc/kubernetes/pki/etcd/healthcheck-client.crt /etc/kubernetes/pki/etcd/healthcheck-client.crt.old
mv /etc/kubernetes/pki/etcd/healthcheck-client.key /etc/kubernetes/pki/etcd/healthcheck-client.key.old
kubeadm alpha phase certs  etcd-healthcheck-client --config /root/kubeadm-kubetest.yaml


mv /etc/kubernetes/pki/etcd/peer.crt /etc/kubernetes/pki/etcd/peer.crt.old
mv /etc/kubernetes/pki/etcd/peer.key /etc/kubernetes/pki/etcd/peer.key.old
kubeadm alpha phase certs  etcd-peer --config /root/kubeadm-kubetest.yaml

*)  Backup old configuration files
mv /etc/kubernetes/admin.conf /etc/kubernetes/admin.conf.old
mv /etc/kubernetes/kubelet.conf /etc/kubernetes/kubelet.conf.old
mv /etc/kubernetes/controller-manager.conf /etc/kubernetes/controller-manager.conf.old
mv /etc/kubernetes/scheduler.conf /etc/kubernetes/scheduler.conf.old

kubeadm alpha phase kubeconfig all  --config /root/kubeadm-kubetest.yaml

mv $HOME/.kube/config .$HOMEkube/config.old
cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
chown $(id -u):$(id -g) $HOME/.kube/config
chmod 777 $HOME/.kube/config
export KUBECONFIG=.kube/config
Reboot the node and check the logs for etcd, kubeapi and kubelet.

Note: Remember to update your CI/CD job kubeconfig file. If you’re using helm command test that also.

https://stackoverflow.com/questions/49885636/kubernetes-expired-certificate

Popularity 6/10 Helpfulness 2/10 Language shell

Source: Grepper

Tags: certificate kubeadm shell x509

Link to this answer
Share Copy Link

Contributed on Jan 21 2023

DreamCoder

0 Answers Avg Quality 2/10

Closely Related Answers

kubeadm x509 certificate has expired or is not yet valid

Comment

# if your cluster was setup with kubeadm do the following to renew your kubernetes cluster certs...
#Try running

kubeadm certs check-expiration
#Commands that are standardised in later versions might have been released as experimental sub commands in older versions of k8s; hence the "alpha" prefix.

#If the above works you can then renew all certs using:

kubeadm certs renew all
#In newer versions of k8s, there is a mechanism to set up jobs that run periodically in order to automatically renew certificates. You would have to make do with doing this manually or scriptifying it with your current k8s version

# In my case the issue started after renewing kubernates certificates, 
# this caused the existing ~/.kube/config to have outdated keys and certificate values in it.
# The solution was to replace the values client-certificate-data and client-key-data in 
# file ~/.kube/config with the values from the updated file in /etc/kubernetes/kubelet.conf of the same name.

https://serverfault.com/questions/1051333/how-to-renew-a-certificate-in-kubernetes-1-12

Popularity 5/10 Helpfulness 10/10 Language shell

Source: Grepper

Tags: kubeadm shell certificate x509

Link to this answer
Share Copy Link

Contributed on Jan 21 2023

DreamCoder

0 Answers Avg Quality 2/10

kubeadm x509 certificate has expired or is not yet valid

Contents

More Related Answers

kubeadm x509 certificate has expired or is not yet valid

Closely Related Answers

kubeadm x509 certificate has expired or is not yet valid

Grepper

Documentation

Social

Legal

Contact

Oops, You will need to install Grepper and log-in to perform this action.