I have HA k8s cluster that was created by kubeadm. I would like to update API server certificate to add additional SANs. For this purpose I followed some steps described in another post, but what I did for HA cluster:

  • Removed API server certificates on all control-plane nodes

  • Retrieved current kubeadm configmap

kubectl get configmap kubeadm-config \
  --namespace kube-system \
  --output jsonpath={{ .data.ClusterConfiguration }}
  • Extended it with necessary configuration part
    - localhost
  • Generated new certificates with updated configuration on all control-plane nodes

kubeadm init phase certs apiserver --config <config_path>

  • Restarted API server container on all control-plane nodes

  • Updated in-cluster configuration

kubeadm init phase upload-config kubeadm --config <config_path>

The question is if these steps are correct or there is another way that is more simple?


The fastest way I come up with is this:

# remove current apiserver certificates
sudo rm /etc/kubernetes/pki/apiserver.*

# generate new certificates
sudo kubeadm init phase certs apiserver --apiserver-cert-extra-sans=localhost,

Remember that you need to run it on all control-plain nodes.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.