kubeadm certs check-expiration command shows certificate expiring

Products

• CA Application Performance Management (APM / Wily / Introscope)

Issue/Introduction

Kubernetes (K8s) cluster for DX Platform:
Using the "kubeadm certs check-expiration" command to check the certificate expiration information, we find that many certificate are expiring soon. How do we proceed?

Resolution

Those Certificates are internal to kubernetes which are not related to DX platform.

You need to discuss this with kubernetes admin on your side as these does not come under DX platform.

We can provide you following information, but you must consult with kubernetes admin to take additional steps to address the issue of certificate expiration which are listed with kubeadm certs check-expiration command.

We can share with you following information that should help you.

These are k8s certificates and it can happen if  kubernetes is not updated for more than 1 year.
k8s doc: https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/

Certificates can be extended or renewed using following document 
https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/

If default self-signed certs are used for k8s, the steps can be like following:

check certs: kubeadm certs check-expiration
if certs expired, run command to update them: kubeadm certs renew all
after updating certs fresh client-certificate-data and client-key-data for kubernetes-admin user will be in  /etc/kubernetes/admin.conf and needs to be updated in ~/.kube/config:
 - open /etc/kubernetes/admin.conf and copy from "users" section "kubernetes-admin" user with fresh client-certificate-data and client-key-data
 - edit ~/.kube/config - replace existing "kubernetes-admin" data in "users" section with data from /etc/kubernetes/admin.conf

Note: It will be more safe to stop DX Platform before making any changes in the Kubernetes (K8s) cluster.