Repository navigation
Initial public release.
Five VKS guest clusters lost their API servers on the anniversary of their nodes' creation: TKG node certificates are valid one year from the node's creation date, and nothing watched Machine.status.certificatesExpiryDate. tkc_cert_renew.sh reads every control plane node, places it in one of four states, ready, restart, renew, problem, and does only what that state needs, one node at a time, so a cluster with no quorum is carried back rather than restored. SANs are compared across the renewal and a node whose SANs changed is never restarted. Then the etcd member list, and certmgr for the certificates kubeadm does not cover. --all for every cluster, selftest for the decision logic, spherelet_cert_check.sh for the ESXi side.
Built and proved out for essential.coach.
Full write-up: https://essential.coach/tkg-certificates-expired-a-year-after-node-creation/
GPL-3.0. Example names only. Nothing secret is printed.