I know there is a manual rotation flow to rotate CA for K8S (Manual Rotation of CA Certificates | Kubernetes), it first rotate to bundled CA and then to new CA, the benefit is it can guarantee the cluster is working during the rotation. But it’s complex and hard to be automated.
My question is that, if I don’t need care about the liveness of the cluster during rotation, can I just replace the old CA and certs with new CA and certs? I test it on a cluster with simple workload, and seems the cluster works fine after all CA and certs are replaced and all pods are restarted. But I’m not sure if this could cause some problems in situations I haven’t cover.
Cluster information:
Kubernetes version:1.30.7
Cloud being used: bare metal
Installation method: CAPI
Host OS: Azure Linux
CNI and version: cilium