medium riskRotation

Certificate rotation

Rotate cluster certificates ahead of expiry and automate future rotation.

Change scope

Control-plane and kubelet certs

Maintenance impact

Minimal if automated; brief API disruption if manual.

Prerequisites
  • ·Inventory of cert expiry dates
  • ·Access to the CA / cert manager
Pre-checks
  • ·Enumerate expiry across control plane and kubelets
Procedure
  1. 1

    Rotate control-plane certs (managed: provider flow; kubeadm: `kubeadm certs renew all`).

  2. 2

    Restart affected control-plane components; confirm kubelet client certs auto-rotate.

Validation
  • ✓No certs within the alert window
  • ✓API + kubelet auth healthy
Rollback

Restore from the pre-rotation backup of the PKI; restart components.

Communication

Low impact; note the maintenance in the change log.