CA rotation for MKE 3 users

The following table maps the MKE 3 certificate commands to their MKE 4 equivalents:

MKE 3	MKE 4
ca --cluster --rotate	Perform the CA rotation. Requires full downtime and worker node rejoin.
ca --etcd --rotate	Perform the CA rotation, etcd CA only. Affects controller nodes only, with no worker node rejoin.
ca --client --rotate	The mkectl certs rotate --client-ca command. Rotates in place with no downtime, but does not revoke user access.
dump-certs	The mkectl certs dump command, which retains the MKE 3 flag names.
No equivalent	The mkectl certs status command. MKE 3 does not report certificate expiry.

Differences in rotation behavior

In MKE 3, the cluster CA is the Swarm root CA, and SwarmKit provides rolling trust rotation. During an MKE 3 rotation, both root CAs are trusted at the same time, nodes reissue their own certificates, MKE tracks convergence on each node, and worker nodes do not rejoin. Manager nodes reboot one at a time, with the leader last, to maintain availability.

k0s provides no equivalent mechanism. Schedule a maintenance window for CA rotation in MKE 4.