Rotating certificates without Kubectl?

[esselfour]

Issue Report Template

Tectonic Version

1.6.10

Environment

Baremetal
What hardware/cloud provider/hypervisor is being used with Tectonic?
Vmware

Expected Behavior

Able to use kubectl to rotate certs

Actual Behavior

Cannot use kubectl due to expiry of certificate.

Reproduction Steps

Using kubectl
The connection to the server kube-a.co.uk:443 was refused - did you specify the right host or port?

Other Information

@IvanCherepov kindly pointed me to the docs on my last post #304 - but as the apiserver seems to have issues it won't be possible to use kubectl. Are there manual steps?

I'd just like to know how to replace the cert safely (I assume it's the apiserver.crt) safely, I've tried manual creation but this hasn't helped! Really stuck here, this has been down for 5 days so desperate for a fix.

Feature Request

Environment

What hardware/cloud provider/hypervisor is being used with Tectonic?

Desired Feature

Other Information

[IvanCherepov]

One workaround might be to download kubectl to the master node and work from there. In this case, you need to specify kubeconfig: kubectl --kubeconfig=/etc/kubernetes/kubeconfig.

[esselfour]

@IvanCherapov - thanks for replying. Ive tried but it still reports the cert error being expired. I have played with the kubeconfig file and edited the host name to the localhost but it reports service unavailable when I attempt kubectl commands.

Any other suggestions? Many thanks!

[kcronin]

I am having the same issue and would love to know if there's any way to get this working without the use of kubectl. I have followed the instructions here, https://coreos.com/tectonic/docs/latest/tls/rotate-tls.html#rotating-the-etcd-ca, at least up to the point of generating all the new certs, but obviously I can't use kubectl to apply the patches because my certs are expired. @IvanCherepov is there ANY way to get this cluster up and running again? Thanks.

[IvanCherepov]

@kcronin are your kubectl commands working with --insecure-skip-tls-verify flag?

[kcronin]

@IvanCherepov sadly no, that didn't work. I have ended up building a new cluster. Thanks for your response, though!

[abh]

@IvanCherepov The default "admin" client certificate expires on the same day the API server certificate does.

[pratikmallya]

If you're unable to destroy the cluster and want to get the control plane working, you will need to generate new certs as described in https://coreos.com/tectonic/docs/latest/tls/rotate-tls.html and then manually replace them. It is quite tedious and you'll have to rotate certs manually (or through a script) from every worker node to get this to work, but it is possible in case re-creating the cluster is not an option