We have a bare-metal k8 cluster deployed using Kubespray, its certificates are expiring soon.
openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -text |grep ' Not '
To update certificates, followed given instructions in official guide.
kubeadm certs renew all
Then removed manifest files in
/etc/kubernetes/manifests/ one by one, but
api-server did not restart after moving its manifest back to
/etc/kubernetes/manifests, had to manually restart the node.
Here, suggest to restart docker container.
My questions are:
- What is the most secure way to update certificates (node restart or docker restart).
- How is the performance impact during this certificate update process?
- Is there a way to define certificate life time in kubespray installation?
Kubernetes version : 1.18.8
Kubeadm : v1.18.8
OS : Ubuntu 18.04