need some help renewing api-server certs running on 1.18 - azure

Question

My prod AKS cluster is running on 1.18 and i'm not able to run any kubectl command because the api-cert is expired a day ago.
cluster is throwing the error below:
x509: certificate has expired or is not yet valid: current time 2022-12-05T12:30:28+05:30 is
I do see there are few blogs referring to rotate certs using the below command.
az aks rotate-certs -g $RESOURCE_GROUP_NAME -n $CLUSTER_NAME
As this is a cluster running on older k8 version, i'm wondering if the above step works.
can this be run during working hours?
running this command will have any impact on the workloads?
any help is greatly appreciated. thanks.

Answer 1

I tried to renew the API server certificate in my environment and got the below results
Kubernetes uses certificates for authentication with many of components
If we have RABC enabled for the cluster then its enabled with the auto rotation for certificate
For checking the expiry date for the certificate
kubectl config view --raw -o jsonpath="{.users[?(#.name == 'clusterUser_rg_cluster_name')].user.client-certificate-data}" | base64 -d | openssl x509 -text | grep -A2 Validity
To check the expiry date of certificate use the below command
az vm run-command invoke -g Alldemorg -n linuxvmaks --command-id RunShellScript --query 'value[0].message' -otsv --scripts "openssl x509 -in /etc/kubernetes/certs/apiserver.crt -noout -enddate"
To upgrade the cluster use the below command
az aks upgrade -g rg_name -n cluster_name
To sign into the cluster
az aks get-credentials -g rg-name -n cluster-name
To rotate all the certificates
az aks rotate-certs -g rg-name -n cluster-name
To verify the old certificates are valid or not by using below command
kubectl get pods
By using above command I am not able to access the kubectl commands
To enable the kubectl commands use the below command
When I check the kubectl command I am able to access
kubectl get nodes