Key Concepts
Certificate
SSL/TLS certificate used by Kubernetes components for secure communication.
Certificate Authority
The CA that signs cluster certificates (ca, etcd-ca, front-proxy-ca).
Renewal
Process of regenerating certificates before expiration.
Expiry
Default Kubernetes certificates expire after 1 year.
Required Permissions
Certificate Status Levels
How to Check Certificate Status
1
Select Cluster
Choose a cluster from the dropdown.
2
View Status
The certificate status page shows overall health and individual certificate details.
3
Review Expiring Certificates
Focus on certificates in Critical or Expiring Soon status.
How to Renew Certificates
1
Select Cluster
Choose the cluster with expiring certificates.
2
Click Renew All
Click Renew All to regenerate all cluster certificates.
3
Confirm
Confirm the renewal operation.
4
Monitor
Wait for the operation to complete. Components will restart with new certificates.
Common Kubernetes Certificates
Troubleshooting
Certificate shows Expired status
Certificate shows Expired status
- Run Renew All immediately
- If cluster is inaccessible, manually renew via SSH on master nodes
- Check kubelet and API server logs after renewal
Renewal operation fails
Renewal operation fails
- Verify SSH connectivity to master nodes
- Ensure kubeadm is available on nodes
- Check sufficient disk space
- Review operation logs for specific errors
Cluster issues after renewal
Cluster issues after renewal
- Components may need time to restart
- Verify API server is accessible
- Check kubelet status on all nodes
- Kubeconfig files may need updating
Cannot view certificate status
Cannot view certificate status
- Verify cluster is in Ready state
- Check you have read permission
- Ensure at least one master node is accessible
FAQ
How often should I check certificates?
How often should I check certificates?
Check monthly. Set up monitoring to alert when certificates enter the 30-day warning threshold.
Can I renew individual certificates?
Can I renew individual certificates?
The platform renews all certificates together. Use kubeadm directly on nodes for individual certificate renewal.
How long are renewed certificates valid?
How long are renewed certificates valid?
Renewed certificates are valid for 1 year from the renewal date.
Does renewal cause downtime?
Does renewal cause downtime?
Brief disruption is possible while components restart. High-availability clusters with multiple masters experience minimal impact.
What about CA certificates?
What about CA certificates?
CA certificates have longer validity (typically 10 years). They are not renewed with regular certificate renewal and require special handling.