Use context: kubectl config use-context k8s-c2-AC

Check how long the kube-apiserver server certificate is valid on cluster2-controlplane1. Do this with openssl or cfssl. Write the exipiration date into /opt/course/22/expiration.

Also run the correct kubeadm command to list the expiration dates and confirm both methods show the same date.

Write the correct kubeadm command that would renew the apiserver server certificate into /opt/course/22/kubeadm-renew-certs.sh.

Checking and Renewing Kubernetes API Server Certificates

Kubernetes relies heavily on certificates to secure communication between its components. The API server’s certificate is one of the most critical, ensuring secure access to the Kubernetes control plane. In this guide, we’ll walk through how to locate the API server certificate, check its expiration date, and renew it if necessary.

Step 1: Locating the API Server Certificate

The first step in managing your Kubernetes API server certificate is to locate the certificate file. Typically, these files are stored in the /etc/kubernetes/pki/ directory on the control plane node.

SSH into your control plane node and find the certificate:

You should see output similar to this:

The file /etc/kubernetes/pki/apiserver.crt is the one we need to inspect.

Step 2: Checking the Certificate Expiration Date

Once you’ve located the certificate file, you can use OpenSSL to check the expiration date. This helps ensure that the certificate is still valid and hasn’t expired.

Run the following command to check the expiration date of the API server certificate:

This command will display the “Not Before” and “Not After” dates, indicating the validity period of the certificate. For example:

In this example, the certificate will expire on Dec 20, 2023.

Step 3: Using kubeadm to Check Certificate Expiration

Kubernetes also provides a built-in command via kubeadm to check the expiration dates of all certificates in the cluster. This can be particularly useful for managing multiple certificates.

To check the expiration date of the API server certificate using kubeadm, run:

The output will show the expiration date along with other relevant details:

This confirms the expiration date and helps you keep track of when to renew your certificates.

Step 4: Renewing the API Server Certificate

If the API server certificate is nearing expiration, it’s crucial to renew it to avoid disruptions in your Kubernetes cluster. The kubeadm command makes this process straightforward.

To renew the API server certificate, use the following command:

This command will generate a new certificate for the API server and ensure continued secure communication within the cluster.

It’s also a good practice to document the renewal process for future reference. For example:

Conclusion

Regularly checking and renewing Kubernetes certificates is essential for maintaining a secure and reliable cluster. By following these steps, you can ensure that your API server and other components continue to function securely without interruption.