Kubernetes (kubeadm) 'x509: certificate has expired or is not yet valid' / kubectl 'Unable to connect to the server' after about a year. How do I check and renew the cluster certificates?

Cause: kubeadm-built clusters create client and server certificates for the control plane (API server, etcd, controller manager, scheduler, admin kubeconfig) that are valid for 1 year by default; the cluster CA lasts 10 years. kubeadm renews them automatically during kubeadm upgrade apply / upgrade node, so clusters that haven't been upgraded for a year suddenly fail: kubectl can't connect, and control plane components can't talk to each other. The 'not yet valid' variant usually means a clock is wrong on a node. Fix: 1. On a control plane node, check: sudo kubeadm certs check-expiration lists each certificate and kubeconfig with its expiry. 2. Renew: sudo kubeadm certs renew all (or renew specific ones). This reuses the existing CA; it doesn't rotate the CA. 3. Restart the control plane static pods so they load the new certificates; kubeadm doesn't do this. The Kubernetes docs suggest temporarily moving the manifests out of /etc/kubernetes/manifests and back so the kubelet recreates the pods. Repeat on every control plane node. 4. Update your kubeconfig: admin.conf is regenerated, so copy it again (sudo cp /etc/kubernetes/admin.conf $HOME/.kube/config, then fix ownership), and redistribute any kubeconfigs built from the old admin credentials. 5. For 'not yet valid' errors, fix time sync (NTP/chrony) on all nodes. 6. Prevent repeats: upgrade the cluster at least yearly (which renews certificates), and monitor expiry (kubeadm certs check-expiration in a scheduled job or your monitoring). Verify: kubeadm certs check-expiration shows new expiry dates, kubectl get nodes works, and control plane pods are Running. Sources: https://kubernetes.io/docs/tasks/administer-cluster/kubeadm/kubeadm-certs/ https://kubernetes.io/docs/reference/setup-tools/kubeadm/kubeadm-certs/