By default, when you setup your Kubernetes cluster, the certificates expires after one year.
The process to check is exactly like the process explained in https://dev.to/hatr0/fixing-expired-certificates-in-kubernetes-1oe2.
I have copied and paste all the needed commands here so no need to visit the post.
Try to issue kubectl commands and you will notice connection refused errors.
The below commands requires 'root' privileged, so if you are login as non-root, you will need to prepend sudo before the commands.
Troubleshooting further, you noticed that your kubelet service is failing to start (systemctl status kubelet).
Upon checking logs related with kubelet (journalctl | grep kubelet), you noticed the belong error messages.
Since the kubelet service on worker nodes talks to control plane, an expired license will prevent the kubelet from authenticating with the API server.
Let's verify our issue with the 'openssl' command.
Let's check kubelet client certificate with the following command:
- "openssl x509 -in /var/lib/kubelet/pki/kubelet-client-current.pem -noout -text | grep 'Not After'"
Not After : Feb 16 00:38:07 2023 GMT
If the date shown is in the past, the certificate has expired.
Let's renew certificates.
If your cluster has more than one worker node, be sure to check certificate expiration with the command above and if certificate has expired, run the following commands on all expired worker nodes in the cluster.
First, let's backup our certificates just in case we need them.
cp /etc/kubernetes/kubelet.conf /etc/kubernetes/kubelet.conf.backupcp -r /var/lib/kubelet/pki /var/lib/kubelet/pki.backup
Next, let's remove the expired certificates
rm /etc/kubernetes/kubelet.conf-
rm /var/lib/kubelet/pki/kubelet-client*- Note: Wildcard might not work due to security restrictions, so delete each file individually.
After you delete the expired certificates, let's generate a new kubelet configuration.
