World K9: Cluster Admin

Certificates and when they expire

You will learn: to read when the office's ID cards expire, and to renew them before they do.

Checked with Kubernetes 1.37 on 1 Nov 2026

The problem

A kubeadm cluster ran fine for a year. This morning the office stops talking. Nobody changed anything. What is a likely cause?

Watch

You are here: cluster kind-dev namespace default

~ $ docker exec -it dev-control-plane bashroot@dev-control-plane:/# kubeadm certs check-expiration[check-expiration] Reading configuration from the "kubeadm-config" ConfigMap in namespace "kube-system"...[check-expiration] Use 'kubeadm init phase upload-config kubeadm --config your-config-file' to re-upload it.CERTIFICATE                EXPIRES                  RESIDUAL TIME   CERTIFICATE AUTHORITY   EXTERNALLY MANAGEDadmin.conf                 Oct 31, 2027 00:54 UTC   364d            ca                      no      apiserver                  Oct 31, 2027 00:54 UTC   364d            ca                      no      apiserver-etcd-client      Oct 31, 2027 00:54 UTC   364d            etcd-ca                 no      apiserver-kubelet-client   Oct 31, 2027 00:54 UTC   364d            ca                      no      controller-manager.conf    Oct 31, 2027 00:54 UTC   364d            ca                      no      etcd-healthcheck-client    Oct 31, 2027 00:54 UTC   364d            etcd-ca                 no      etcd-peer                  Oct 31, 2027 00:54 UTC   364d            etcd-ca                 no      etcd-server                Oct 31, 2027 00:54 UTC   364d            etcd-ca                 no      front-proxy-client         Oct 31, 2027 00:54 UTC   364d            front-proxy-ca          no      scheduler.conf             Oct 31, 2027 00:54 UTC   364d            ca                      no      super-admin.conf           Oct 31, 2027 00:54 UTC   364d            ca                      no      CERTIFICATE AUTHORITY   EXPIRES                  RESIDUAL TIME   EXTERNALLY MANAGEDca                      Oct 28, 2036 00:54 UTC   9y              no      etcd-ca                 Oct 28, 2036 00:54 UTC   9y              no      front-proxy-ca          Oct 28, 2036 00:54 UTC   9y              no      root@dev-control-plane:/# exitexit

Every part shows an ID card to the others. Each card has a date. kubeadm certs check-expiration lists them all.

Try it

The last table lists the signers. Tap the lines that last 9 years.

Tap every signer that lasts 9 years.

0 of 3 found

A signs every card. kubeadm makes its CAs last ten years.

Predict

You run kubeadm certs renew all. It says “renewed” for each card. Yet the API server still shows the old one. Why?

Try it

Renew the API server’s card, then check the dates again. Renewing changes the office, so the danger note shows.

You are here: cluster kind-dev namespace default

dev-control-planeOpenManager

No trays here.

dev-workerOpen

No trays here.

dev-worker2Open

No trays here.

Time: +0s (sped up)

Check

Put a renewal day in order.

First step at the top. Put these in order. Use the arrows, or drag.

kubeadm certs check-expiration
Copy the new admin.conf to ~/.kube/config
Restart the control-plane pods: move each manifest out, wait 20 s, move it back
kubeadm certs renew all

Check

Who keeps each card fresh? Sort them.

Drag a card into a box. Or tap the card, then tap the box.

You did it!

You can now read certificate expiry dates and renew in time.

Go deeper (optional)

kubeadm upgrade renews the certificates too. So a yearly upgrade keeps the cards fresh. Many teams also set an alarm a month before the date.

Real mission

On a throwaway kind cluster, read the dates. It only looks.
docker exec <cluster>-control-plane kubeadm certs check-expiration
Renew one card on that practice cluster.
docker exec <cluster>-control-plane kubeadm certs renew apiserver
Read the dates again. Spot the new one.
docker exec <cluster>-control-plane kubeadm certs check-expiration

0 of 3 steps done · Your ticks are saved.