Auto renew kubelet certificate and check it exparation

General Discussions
1

Hello I’m using kubespray for k8s deployment.
Please could you help?
How can i check kubelet certificate expiration?
How can i update (renew) kubelet certificate on all nodes (master and worker)?
I allready know about autorenewing master-nodes certificates.

But i did not find info to howo to check and update kubelet certificate.

Thank’s in advance

2

Quick example. I’m assuming this is what you’re trying to do.

$ kubectl run -it alpine --image=alpine:latest -- sh
If you don't see a command prompt, try pressing enter.


/ # apk add curl
fetch https://dl-cdn.alpinelinux.org/alpine/v3.13/main/x86_64/APKINDEX.tar.gz
fetch https://dl-cdn.alpinelinux.org/alpine/v3.13/community/x86_64/APKINDEX.tar.gz
(1/5) Installing ca-certificates (20191127-r5)
(2/5) Installing brotli-libs (1.0.9-r3)
(3/5) Installing nghttp2-libs (1.42.0-r1)
(4/5) Installing libcurl (7.76.1-r0)
(5/5) Installing curl (7.76.1-r0)
Executing busybox-1.32.1-r6.trigger
Executing ca-certificates-20191127-r5.trigger
OK: 8 MiB in 19 packages


/ # curl -kIv https://kubernetes.default.svc.cluster.local
*   Trying 10.96.0.1:443...
* Connected to kubernetes.default.svc.cluster.local (10.96.0.1) port 443 (#0)
...
* Server certificate:
*  subject: CN=kube-apiserver
*  start date: May 21 00:10:27 2021 GMT
*  expire date: May 21 00:10:27 2022 GMT
*  issuer: CN=kubernetes
*  SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
...

/ # exit
Session ended, resume using 'kubectl attach alpine -c alpine -i -t' command when the pod is running

$ kubectl delete pod alpine --force
warning: Immediate deletion does not wait for confirmation that the running resource has been terminated. The resource may continue to run on the cluster indefinitely.
pod "alpine" force deleted