Introduction

Every Kubernetes cluster secured with kubeadm relies on TLS certificates to protect communication between the control plane components. These certificates have a limited validity period and must be renewed before they expire.

If certificate expiration is ignored, administrators may experience issues such as:

  • Unable to connect using kubectl
  • API Server authentication failures
  • Control plane components failing to communicate
  • etcd connectivity issues
  • Cluster becoming partially or completely unavailable

Fortunately, kubeadm provides a straightforward method to renew certificates with minimal disruption.

In this guide, you’ll learn how to safely renew Kubernetes certificates, restart the required control plane components, and verify that the renewal was successful.

Why Kubernetes Certificate Renewal Matters

Kubernetes secures communication using X.509 certificates. These certificates authenticate communication between:

  • Kubernetes API Server
  • Controller Manager
  • Scheduler
  • etcd
  • kubelets
  • kubectl clients

By default, certificates generated by kubeadm are valid for approximately one year.

If these certificates expire, critical services may stop functioning, making the cluster difficult—or even impossible—to manage.

Regularly checking certificate expiration should be part of every Kubernetes administrator’s maintenance routine.

Prerequisites

Before renewing certificates, ensure you have:

  • Root or sudo access to the Kubernetes control plane node
  • A Kubernetes cluster initialized using kubeadm
  • kubectl installed and configured
  • Recent backups of:
    • /etc/kubernetes
    • /var/lib/etcd (recommended)
  • Maintenance window (recommended for production environments)

Reference Links:

How to install kubernetes cluster using k3s on centos-7

Step 1: Check Certificate Expiration

Before making any changes, check the current expiration dates.

kubeadm certs check-expiration

If the remaining validity is only a few weeks or days, renew the certificates immediately.

Step 2: Renew All Kubernetes Certificates

Renew every certificate managed by kubeadm.

kubeadm certs renew all

Important

This command does not restart Kubernetes components.

It only replaces the certificate files on disk.

Step 3: Update Your kubeconfig

Since admin.conf has been regenerated, update your local kubeconfig.

cp /etc/kubernetes/admin.conf ~/.kube/config

Without this step, kubectl may continue using the old client certificate.

Step 4: Restart the Kubernetes API Server

The API Server must reload the new certificates.

Because kubeadm creates static Pods, restarting is done by temporarily moving the manifest.

mv /etc/kubernetes/manifests/kube-apiserver.yaml /tmp/
sleep 5
mv /tmp/kube-apiserver.yaml /etc/kubernetes/manifests/

Wait for the API Server to restart.

sleep 15
kubectl get nodes

Do not continue until the API Server is healthy.

Step 5: Restart the Controller Manager

Restart the Controller Manager.

mv /etc/kubernetes/manifests/kube-controller-manager.yaml /tmp/
sleep 5
mv /tmp/kube-controller-manager.yaml /etc/kubernetes/manifests/

Verify cluster health.

sleep 10
kubectl get nodes

Step 6: Restart the Scheduler

Restart the Scheduler.

mv /etc/kubernetes/manifests/kube-scheduler.yaml /tmp/
sleep 5
mv /tmp/kube-scheduler.yaml /etc/kubernetes/manifests/

Verify the cluster.

sleep 10
kubectl get nodes

Step 7: Restart etcd

Restart etcd last.

mv /etc/kubernetes/manifests/etcd.yaml /tmp/
sleep 5
mv /tmp/etcd.yaml /etc/kubernetes/manifests/

Allow additional startup time.

sleep 20
kubectl get nodes

Step 8: Verify Certificate Renewal

Finally, confirm that every certificate has been renewed.

kubeadm certs check-expiration

If all certificates show approximately 364 days remaining, the renewal has been completed successfully.

Why Restart Components One at a Time?

Restarting all control plane components simultaneously can temporarily make the Kubernetes control plane unavailable.

A sequential restart provides several advantages:

  • Easier troubleshooting
  • Reduced operational risk
  • Controlled recovery
  • Faster identification of issues

Always verify the cluster after each restart before proceeding to the next component.

Conclusion

Renewing Kubernetes certificates is a critical maintenance task that helps ensure secure communication across your cluster. Using kubeadm, administrators can renew all control plane certificates with a simple command and then restart each control plane component sequentially to apply the updated certificates.

By following the steps outlined in this guide—checking expiration dates, renewing certificates, updating admin.conf, restarting components one at a time, and verifying the results—you can complete the renewal process safely and with minimal disruption. Incorporating certificate checks into your regular maintenance schedule will help prevent unexpected outages and keep your Kubernetes environment secure and reliable.

Related Articles:

Kubernetes ELK Logging Setup: Filebeat → Logstash → Kibana

How to Configure Kubernetes Ingress with Automatic SSL Certificates (Without Helm)

Post Views: 0

Leave a Reply