Refresh certificates not deployed on all nodes

[step-team-jf]

Hi,

Summary

I encountered an issue with the metrics server related to invalid certificates.

I checked the status of the certificates on my clusters and found that the client certificate for the front-end proxy had expired.

microk8s refresh-certs -c

The CA certificate will expire in 3200 days.
The server certificate will expire in 280 days.
The front proxy client certificate will expire in -85 days.

I logged in the master node and refreshed successfully proxy client certificate with the command

microk8s refresh-certs -e front-proxy-client.crt
microk8s refresh-certs -c

The CA certificate will expire in 3200 days.
The server certificate will expire in 280 days.
The front proxy client certificate will expire in 364 days

However, it seems that the new certificate is not deployed on all the nodes of my cluster.

What Should Happen Instead?

What is the process to deploy to new certificates on all node (without Leave/Join)

Kind regards,
Jean-François

[bschimke95]

Hey @step-team-jf

The nodes need to re-join the cluster. See note in this section: https://microk8s.io/docs/command-reference#heading--microk8s-refresh-certs

In a multi-node setup, nodes will need to leave and rejoin the cluster in order for new certificates to properly propagate.