Renew Kubernetes Cluster Certificates

Certificate renewal is a high-impact maintenance operation. Confirm how the cluster was created before applying kubeadm commands, because managed and custom clusters may use different PKI workflows.

Check expiration:

sudo kubeadm certs check-expiration

Back up /etc/kubernetes/pki, kubeconfig files, and the etcd data required for recovery. Renew kubeadm-managed certificates:

sudo kubeadm certs renew all

Regenerate or copy updated administrator kubeconfig files as required. Static control-plane pods normally restart when their manifests or certificate-dependent state changes; otherwise restart components carefully one node at a time.

Validate API access, node readiness, controller and scheduler health, etcd membership, service networking, and application workloads. Inspect certificate subjects, issuers, and expiration dates rather than assuming the command succeeded.

For a highly available control plane, repeat the reviewed process on each relevant node and understand which certificates and certificate authorities are shared. Never replace a CA casually, because CA rotation is different from renewing leaf certificates.