Introduction

When kubeadm-managed Kubernetes certificates expire, the control plane can stop functioning cleanly and kubectl access may fail. The recovery path is usually to work directly on a control-plane node, renew the certificates with kubeadm, and restart the control-plane static pods so they reload the new files. This is operational work, so take a backup first and move carefully.

Confirm the Cluster Uses kubeadm PKI

The commands in this article assume the cluster was bootstrapped with kubeadm and stores certificates under /etc/kubernetes/pki. If the cluster uses a different certificate management flow, the right recovery steps may be different.

Before changing anything, back up the certificate and kubeconfig material:

sudo cp -a /etc/kubernetes /etc/kubernetes.backup.$(date +%Y%m%d-%H%M%S)

Then inspect certificate status on a control-plane node:

sudo kubeadm certs check-expiration

If the cluster has multiple control-plane nodes, plan to repeat the renewal on each one.

Renew the Certificates

For the common kubeadm case, renew everything with:

sudo kubeadm certs renew all

You can also renew individual certificates if only a subset is affected, but in an expiration recovery scenario it is often simpler to renew the whole set consistently.

kubeadm certs renew uses the existing local certificate files as the source for identity details such as subject and SAN information, so you typically do not re-enter those values during renewal.

Restart the Control-Plane Components

Renewing the files is not enough by itself. The control-plane components must reload the updated certificates. For kubeadm static pods, the official operational approach is to restart them by letting kubelet recreate them from the manifest directory.

The manifests live here:

/etc/kubernetes/manifests/

A typical sequence for one component is:

1sudo mv /etc/kubernetes/manifests/kube-apiserver.yaml /tmp/
2sleep 20
3sudo mv /tmp/kube-apiserver.yaml /etc/kubernetes/manifests/
4sleep 20

Repeat the same pattern for kube-controller-manager.yaml, kube-scheduler.yaml, and local etcd.yaml if that node runs stacked etcd and its certificates were renewed.

The point is not the exact sleep duration by itself. The point is to let kubelet observe the manifest removal and then recreate the static pod with the renewed certificate files.

Refresh Client Access

If admin.conf was renewed, refresh your local kubeconfig copy as well:

sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

Without this step, the control plane may be healthy again while your local client still presents an expired admin certificate.

Validate Recovery

After the control-plane components come back, verify the node and API health:

kubectl get nodes
kubectl get pods -A
sudo kubeadm certs check-expiration

On replicated control planes, perform the renewal on each control-plane node, then re-check overall cluster health when all of them have rotated and restarted cleanly.

Common Pitfalls

The biggest mistake is treating all Kubernetes clusters the same. These steps are for kubeadm-managed PKI. Managed cloud clusters or clusters with external certificate tooling may need a different renewal process.

Another issue is renewing the files but forgetting to restart the static pods. The certificates on disk may be fresh while the running components are still using the old in-memory material.

People also often fix the control plane and forget admin.conf. That leaves kubectl broken on the administrator machine even though the cluster itself is running again.

Finally, do not skip the backup. Expired certificates are already a recovery situation, and certificate or kubeconfig mistakes are much easier to undo if you saved the original state first.

Summary

• Work directly on a control-plane node and confirm the cluster uses kubeadm-managed PKI.
• Back up /etc/kubernetes before changing certificate files.
• Use kubeadm certs check-expiration to inspect the current state.
• Renew the certificates with kubeadm certs renew all and restart the control-plane static pods.
• Refresh $HOME/.kube/config from /etc/kubernetes/admin.conf if the admin client certificate was renewed.