Update certificates for system components in a Managed Kubernetes cluster

To interact, Kubernetes system components require valid certificates. They are updated automatically every 30 days. If an error occurs during the certificate update, you can update the certificates in the Control panel or via the Managed Kubernetes API.

Information about certificate updates is reflected in the cluster logs.

Every time certificates are updated, the kubeconfig file changes, therefore you need to reconnect to the cluster. To avoid reconnecting, configure updates via a ServiceAccount Token.

Update certificates when an error occurs

If an error ROTATE CERTS = ERROR occurred during the automatic certificate update, you can update the certificates in the Control panel or via the Managed Kubernetes API.

In the Control panel, on the top menu, click Products and select Managed Kubernetes.
Open the cluster page → Settings tab.
In the Cluster access block, click Update certificates.
Reconnect to the cluster.

Configure certificate updates via ServiceAccount Token

A ServiceAccount Token is a way to authorize in the Kubernetes API. It allows you not to update the kubeconfig file after every certificate update.

The process of obtaining a ServiceAccount Token depends on the Kubernetes version:

for Kubernetes version 1.23 and lower;
for Kubernetes version 1.24 and higher.

For Kubernetes version 1.23 and lower

Linux
Windows

Create a ServiceAccount:
```
kubectl -n kube-system create serviceaccount <serviceaccount_name>
```
Specify <serviceaccount_name> — the name of the service account.
Create a ClusterRoleBinding (a group for the new user) and add a role with administrator rights (cluster-admin):
```
kubectl create clusterrolebinding <clusterrolebinding_name> --clusterrole=cluster-admin --serviceaccount=kube-system:<serviceaccount_name>
```
Specify <clusterrolebinding_name> — the name of the group for the new user.

Add the name of the secret of the created ServiceAccount that stores the token to the TOKENNAME environment variable:

export TOKENNAME=$(kubectl -n kube-system get serviceaccount/<serviceaccount_name> -o jsonpath='{.secrets[0].name}')

Add the decoded token from the secret to the TOKEN environment variable:

export TOKEN=$(kubectl -n kube-system get secret $TOKENNAME -o jsonpath='{.data.token}' | base64 --decode)

Check if the token works — make a request to the Kubernetes API with the token in the header:
```
curl -k -H "Authorization: Bearer $TOKEN" -X GET "https://<kube_api_ip>:6443/api/v1/nodes" | json_pp
```
Specify <kube_api_ip> — the cluster IP address in the Control panel.

Add the ServiceAccount to the kubeconfig file:

kubectl config set-credentials <serviceaccount_name> --token=$TOKEN

Switch the context:

kubectl config set-context --current --user=<serviceaccount_name>

Check if it works — make any request to the Kubernetes API. For example, request a list of cluster nodes:
```
kubectl get nodes
```
The updated kubeconfig file will be located in the $HOME/.kube/config home directory

For Kubernetes version 1.24 and higher

Linux
Windows

Create a ServiceAccount:
```
kubectl -n kube-system create serviceaccount <serviceaccount_name>
```
Specify <serviceaccount_name> — the service account name.
Create a ClusterRoleBinding (a group for the new user) and add a role with administrator rights (cluster-admin):
```
kubectl create clusterrolebinding <clusterrolebinding_name> --clusterrole=cluster-admin --serviceaccount=kube-system:<serviceaccount_name>
```
Specify <clusterrolebinding_name> — the group name for the new user.

Get the name of the secret of the created ServiceAccount that stores the token:

kubectl -n kube-system apply -f - <<EOF
apiVersion: v1
kind: Secret
metadata:
  name: <serviceaccount_name>-token
  annotations:
    kubernetes.io/service-account.name: <serviceaccount_name>
type: kubernetes.io/service-account-token
EOF

Add the decoded token from the secret to the TOKEN environment variable:

export TOKEN=$(kubectl -n kube-system get secret <serviceaccount_name>-token -o jsonpath='{.data.token}' | base64 --decode)

Check if the token works — make a request to the Kubernetes API with the token in the header:
```
curl -k -H "Authorization: Bearer $TOKEN" -X GET "https://<kube_api_ip>:6443/api/v1/nodes" | json_pp
```
Specify <kube_api_ip> — the cluster IP address in the Control panel.

Add the ServiceAccount to the kubeconfig file:

kubectl config set-credentials <serviceaccount_name> --token=$TOKEN

Switch the context:

kubectl config set-context --current --user=<serviceaccount_name>

Check if it works — make any request to the Kubernetes API. For example, request a list of cluster nodes:
```
kubectl get nodes
```
The updated kubeconfig file will be located in the $HOME/.kube/config home directory