Recovering from expired control plane certificates

Recovering from expired control plane certificates

The cluster can automatically recover from expired control plane certificates.

However, you must manually approve the pending node-bootstrapper certificate signing requests (CSRs) to recover kubelet certificates. For user-provisioned installations, you might also need to approve pending kubelet serving CSRs.

Use the following steps to approve the pending CSRs:

Procedure

  1. Get the list of current CSRs:

    1. $ oc get csr

    Example output

    1. NAME        AGE    SIGNERNAME                                    REQUESTOR                                                                   CONDITION
    2. csr-2s94x   8m3s   kubernetes.io/kubelet-serving                 system:node:<node_name>                                                     Pending (1)
    3. csr-4bd6t   8m3s   kubernetes.io/kubelet-serving                 system:node:<node_name>                                                     Pending (1)
    4. csr-4hl85   13m    kubernetes.io/kube-apiserver-client-kubelet   system:serviceaccount:openshift-machine-config-operator:node-bootstrapper   Pending (2)
    5. csr-zhhhp   3m8s   kubernetes.io/kube-apiserver-client-kubelet   system:serviceaccount:openshift-machine-config-operator:node-bootstrapper   Pending (2)
    6. ...
    1A pending kubelet service CSR (for user-provisioned installations).
    2A pending node-bootstrapper CSR.

  2. Review the details of a CSR to verify that it is valid:

    1. $ oc describe csr <csr_name> (1)
    1<csr_name> is the name of a CSR from the list of current CSRs.

  3. Approve each valid node-bootstrapper CSR:

    1. $ oc adm certificate approve <csr_name>

  4. For user-provisioned installations, approve each valid kubelet serving CSR:

    1. $ oc adm certificate approve <csr_name>