Manually Replace Kubernetes Cluster Certificates deployed by Container Service Extension.

Products

• VMware Cloud Director

Issue/Introduction

Certificates on the Kubernetes Cluster Node deployed by Container Service Extension (CSE) have expired.

Environment

• VMware Cloud Director 10.6.x
• VMware Cloud Director 10.5.x
• VMware Cloud Director Container Service Extension 4.2.x

Cause

Kubernetes has a default certificate expiration time of 1 year. VMware by Broadcom products adhere to this certificate expiration timeframe.

Resolution

Follow these steps to manually renew certificates:

1. Login as root via SSH or VM console to each control plane node VM of the Kubernetes cluster.
   NOTE: Verify the auto generated root password by opening the control plane node VM in the VCD UI and opening Guest OS Customization > Edit.
2. Check the current certificates-expiration date by using the 'kubeadm certs check-expiration' command on each primary node of your cluster:
   kubeadm certs check-expiration
3. To renew the certificates, use the 'kubeadm certs renew all' command on each primary node of your Kubernetes cluster:
   kubeadm certs renew all
4. Recheck the expiration date using the 'kubeadm certs check-expiration command' on each primary node of your cluster:
   kubeadm certs check-expiration
5. Download the Kubernetes cluster's kubeconfg file from the VCD UI from Kubernetes Container Clusters > select Kubernetes cluster > Download Kube Config.
6. Move the downloaded kubeconfg file to a client with kubectl installed and export it for use in kubectl commands:
   export KUBECONFIG=/<path_to_kubeconfig>/<kubeconfig_file_name>
7. Restart the following control plane pods after the certificate renewal using the commands:
   kubectl get pods -n kube-system
kubectl -n kube-system delete pod -l 'component=kube-apiserver'
kubectl -n kube-system delete pod -l 'component=etcd'
kubectl -n kube-system delete pod -l 'component=kube-scheduler'
kubectl -n kube-system delete pod -l 'component=kube-controller-manager'

 

NOTE-Please refer the following documentation for more information:

Certificate Management with kubeadm

kubeadm certs