Skip to content

Recover from a failed CA rotation#

A partial CA rotation has no rollback. To recover, restore the backup that you created before the rotation. For more information, refer to Restore.

The restore operation bootstraps a new single-node cluster from the backup archive. You then add the remaining nodes with the mkectl node add command, and the Windows worker nodes, if any, with the mkectl apply command. Review the restore procedure before you begin the rotation.

The restored cluster uses its original CAs, as the backup includes the certificate directory. The cluster returns to its pre-rotation state, without any changes written after the backup.

Decide whether to continue or restore#

If the rotation fails partway, use the following criteria to decide whether to continue or restore:

  • If the controller nodes have started with the new CAs and some worker nodes have not yet rejoined, the cluster is recoverable. Continuing the procedure is typically faster than restoring.
  • If the controller nodes hold different CAs from one another, the cluster is not recoverable by continuing. Restore from backup.