kubeadm certs check-expiration
kubeadm certs check-expiration | kubeadm certs renew all|<name>
Risk: Careful
What it does
Shows when the control plane's certificates expire, and renews them. The CAs are not renewed.
When to use it
Check a few times a year. Renew before the date, then restart the control-plane pods.
Example
$ kubeadm certs check-expirationOn the control-plane node: when does each card expire? It only looks.
$ kubeadm certs renew apiserverRenew one card. Then restart the API server's pod.
$ kubeadm certs renew allRenew every card kubeadm manages. Copy the new admin.conf after.
Learn it in: Certificates and when they expire · Official docs