Kubernetes certificates expired- errors after renew

[Luca Razzi]

hello commuity
I have renewd all the certificates in the kubernetes cluster
Now I can only see pods but if I get logs or exec -it on the pod I get errors:

root@WILY-ELASTIC1 .kube]# kubectl logs jarvis-elasticsearch-2-7bdc5c67c4-w7lhh -ndxi
error: You must be logged in to the server (the server has asked for the client to provide credentials ( pods/log jarvis-elasticsearch-2-7bdc5c67c4-w7lhh))
[root@WILY-ELASTIC1 .kube]#

I think my /root/.kube/config is bad with the new certs
Please help if u can
Otherwise I have to scracth the k8s cluster

Best regards

Luca Razzi

[Luca Razzi]

Dear community
I solved the issue
After renewal of certs is mandatory a reboot of the master server of k8s, where config is installed
Now after rebooting master and after restarting the kubelet averything works fine

Thanks 

Luca Razzi

[Jörg Mertin]

Hi Luca,
I had the same issue with one of my clusters. I had restarted my cluster using the drain&uncordon method. But it took a long time to actually get it all up because the certificate caused issues on the nodes and m.a.s.t.e.r communication during the change. And you have to follow the correct order.

IMHO, a reboot is the best method in that case. Well done!

[Luca Razzi]

Dont understand what is the issue

It seems that the **** node has the client certificate for the kubelet not updated, but it will be updated after reboot

Only the reboot can update it

 

Dont know way but it works

 

Also the admin.conf must be replaced from /etc/kubernetes to /root/.kube path after certs renew

 

LR