From ae329ee1928df50b0076d6a74572a6d58a09b7ed Mon Sep 17 00:00:00 2001 From: Ali Afsharzadeh Date: Fri, 21 Aug 2026 10:37:16 +0330 Subject: [PATCH] Fix k8s-certs-renew renewing all certificates on every timer run (#13413) * Fix k8s-certs-renew renewing all certificates on every timer run Signed-off-by: Ali Afsharzadeh * Strip trailing whitespace from systemd-analyze calendar output Signed-off-by: Ali Afsharzadeh * Remove issue link Co-authored-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com> --------- Signed-off-by: Ali Afsharzadeh Co-authored-by: ChengHao Yang <17496418+tico88612@users.noreply.github.com> --- .../control-plane/templates/k8s-certs-renew.sh.j2 | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/roles/kubernetes/control-plane/templates/k8s-certs-renew.sh.j2 b/roles/kubernetes/control-plane/templates/k8s-certs-renew.sh.j2 index 6f2b03eff..47d52e23e 100644 --- a/roles/kubernetes/control-plane/templates/k8s-certs-renew.sh.j2 +++ b/roles/kubernetes/control-plane/templates/k8s-certs-renew.sh.j2 @@ -5,9 +5,11 @@ echo "## Check Expiration before renewal ##" {{ bin_dir }}/kubeadm certs check-expiration days_buffer=7 # set a time margin, because we should not renew at the last moment -next_time=$(systemctl show k8s-certs-renew.timer -p NextElapseUSecRealtime --value) +# systemctl show reports an empty NextElapseUSecRealtime while the timer's unit is +# running, so use the calendar spec to get the next scheduled run. +next_time=$(LC_ALL=C systemd-analyze calendar "{{ auto_renew_certificates_systemd_calendar }}" | grep -oP 'Next elapse:\s*\K.*\S') -if [ "${next_time}" == "" ]; then +if [ "${next_time}" == "" ] || [ "${next_time}" == "never" ]; then echo "## Skip expiry comparison due to fail to parse next elapse from systemd calendar,do renewal directly ##" else current_time=$(date +%s)