From e125a30b1692fd9bb93ab0faf994da6e666a00de Mon Sep 17 00:00:00 2001 From: Ali Afsharzadeh Date: Thu, 3 Sep 2026 18:00:21 +0330 Subject: [PATCH] Fix k8s-certs-renew renewing on nodes without super-admin.conf (#13414) Signed-off-by: Ali Afsharzadeh --- .../control-plane/templates/k8s-certs-renew.sh.j2 | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/roles/kubernetes/control-plane/templates/k8s-certs-renew.sh.j2 b/roles/kubernetes/control-plane/templates/k8s-certs-renew.sh.j2 index 47d52e23e..a06afff6e 100644 --- a/roles/kubernetes/control-plane/templates/k8s-certs-renew.sh.j2 +++ b/roles/kubernetes/control-plane/templates/k8s-certs-renew.sh.j2 @@ -15,11 +15,16 @@ else current_time=$(date +%s) target_time=$(date -d "${next_time} + ${days_buffer} days" +%s) # $next_time - $days_buffer days expiry_threshold=$(( ${target_time} - ${current_time} )) - expired_certs=$({{ bin_dir }}/kubeadm certs check-expiration -o jsonpath="{.certificates[?(@.residualTime<${expiry_threshold}.0)]}") + # super-admin.conf only exists on the node where "kubeadm init" ran, the other + # control plane nodes see it as missing (residualTime 0). Don't let missing + # certs force a renewal here, kubeadm can't renew them anyway. + expired_certs=$({{ bin_dir }}/kubeadm certs check-expiration -o jsonpath="{range .certificates[?(@.residualTime<${expiry_threshold}.0)]}{.name}={.missing}{\"\n\"}{end}" | sed -n 's/=false$//p') if [ "${expired_certs}" == "" ];then echo "## Skip cert renew and K8S container restart, since all residualTimes are beyond threshold ##" exit 0 fi + echo "## Certificates to renew: ##" + echo "${expired_certs}" fi echo "## Renewing certificates managed by kubeadm ##"