{"id":11376,"date":"2025-01-17T09:01:45","date_gmt":"2025-01-17T14:01:45","guid":{"rendered":"https:\/\/www.rushworth.us\/lisa\/?p=11376"},"modified":"2025-01-21T10:23:36","modified_gmt":"2025-01-21T15:23:36","slug":"11376","status":"publish","type":"post","link":"https:\/\/www.rushworth.us\/lisa\/?p=11376","title":{"rendered":"Kubernetes: Renewing Client Admin Cert"},"content":{"rendered":"\n<p>When the certificate for a k8s manager account has expired, create a new key request for the same CN and sign it against the k8s CA:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n#!\/bin\/bash\n# Run this from the K8s controller where the platform&#039;s CA keys are located\ncd ~\/kubectl_cert\/\n\n# Get the current year\ncurrent_year=$(date +%Y)\n\n# Generate private key\nopenssl genpkey -algorithm RSA -out kubectl-${current_year}-k8admin-key.pem\n\n# Generate CSR\nopenssl req -new -key kubectl-${current_year}-k8admin-key.pem -out kubectl-${current_year}-k8admin.csr -subj &quot;\/O=system:masters\/CN=kubernetes-admin&quot;\n\n# Sign the CSR to create a certificate\nopenssl x509 -req -in kubectl-${current_year}-k8admin.csr -CA \/etc\/kubernetes\/pki\/ca.crt -CAkey \/etc\/kubernetes\/pki\/ca.key -CAcreateserial -out kubectl-${current_year}-k8admin-cert.pem -days 365 -extensions v3_req\n\n# Check expiry is in future\nopenssl x509 -in kubectl-${current_year}-k8admin-cert.pem -noout -enddate\n\n# Update kubeconfig with new credentials\nkubectl config set-credentials kubernetes-admin --client-certificate=~\/kubectl_cert\/kubectl-${current_year}-k8admin-cert.pem --client-key=~\/kubectl_cert\/kubectl-${current_year}-k8admin-key.pem\n<\/pre><\/div>","protected":false},"excerpt":{"rendered":"<p>When the certificate for a k8s manager account has expired, create a new key request for the same CN and sign it against the k8s CA:<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1541],"tags":[2082,1542,624,615],"class_list":["post-11376","post","type-post","status-publish","format-standard","hentry","category-kubernetes","tag-client-certificate","tag-k8s","tag-kubectl","tag-kubernetes"],"_links":{"self":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/11376","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=11376"}],"version-history":[{"count":2,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/11376\/revisions"}],"predecessor-version":[{"id":11378,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/11376\/revisions\/11378"}],"wp:attachment":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11376"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11376"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11376"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}