# Ok to directly replace CA rather than rotation CA for K8S?

**URL:** <https://discuss.kubernetes.io/t/ok-to-directly-replace-ca-rather-than-rotation-ca-for-k8s/31256>\
**Category:** General Discussions\
**Tags:** security\
**Created:** [January 15, 2025, 8:45am UTC](https://discuss.kubernetes.io/t/ok-to-directly-replace-ca-rather-than-rotation-ca-for-k8s/31256 "2025-01-15T08:45:46Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![wyz159753](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/wyz159753/32/16395_2.png) [@wyz159753](https://discuss.kubernetes.io/u/wyz159753)\
**Post date:** [January 15, 2025, 8:45am UTC](https://discuss.kubernetes.io/t/ok-to-directly-replace-ca-rather-than-rotation-ca-for-k8s/31256/1 "2025-01-15T08:45:46Z")

</div>

I know there is a manual rotation flow to rotate CA for K8S ([Manual Rotation of CA Certificates | Kubernetes](https://kubernetes.io/docs/tasks/tls/manual-rotation-of-ca-certificates/)), it first rotate to bundled CA and then to new CA, the benefit is it can guarantee the cluster is working during the rotation. But it’s complex and hard to be automated.

My question is that, if I don’t need care about the liveness of the cluster during rotation, can I just replace the old CA and certs with new CA and certs? I test it on a cluster with simple workload, and seems the cluster works fine after all CA and certs are replaced and all pods are restarted. But I’m not sure if this could cause some problems in situations I haven’t cover.

### Cluster information:

Kubernetes version:1.30.7  
Cloud being used: bare metal  
Installation method: CAPI  
Host OS: Azure Linux  
CNI and version: cilium