Skip to content

Verify the CA rotation#

After you perform the CA rotation, verify your access, the certificates, the cluster health, and any child clusters.

Obtain a new kubeconfig file#

Your existing kubeconfig file no longer matches the cluster, and mkectl uses it for all of the verification steps that follow. Obtain a new kubeconfig file before you run any other verification. The mkectl kubeconfig command prints to stdout, so redirect the output to the default kubeconfig path for mkectl:

mkectl kubeconfig > mke.kubeconf.new
mv mke.kubeconf.new ~/.mke/mke.kubeconf

kubectl get nodes

The previous kubeconfig file fails with a certificate error. Distribute new kubeconfig files to every other user and to all automation that holds one.

Verify the certificates#

  1. Record the post-rotation certificate state:

    mkectl certs status --include-node-pki -o json > certs-after.json

  2. Verify that the output states that the node tier was inspected.

  3. Compare the post-rotation state against the baseline that you recorded during preparation:

    diff <(jq -S . certs-before.json) <(jq -S . certs-after.json)

    Every k0s-issued certificate shows a new notBefore value and a new expiry date. The MKE Client Root CA and any user-supplied certificates remain unchanged. If either changed, the procedure deleted more files than intended.

Verify the cluster health#

  1. Verify the status of the cluster, nodes, and Pods:

    mkectl status
sudo k0s kubectl get nodes
sudo k0s kubectl get pods --all-namespaces

    All nodes show Ready.

  2. Investigate any Pod in the CreateContainerConfigError state or with token mount errors. These errors indicate a workload that reads its token from a legacy Secret rather than from a projected volume. For more information, refer to ServiceAccount tokens.

  3. If any MKE system component fails to recover, restart it so that it obtains a new token:

    kubectl rollout restart deployment -n mke
kubectl rollout restart deployment -n k0rdent

Verify the child clusters#

If you run MKE 4 child clusters, verify that each child cluster continues to reconcile. Before you consider the rotation complete, test that you can provision a new child node. A child cluster that appears healthy can still fail its next node provisioning. For more information, refer to MKE 4 child clusters.