Have the certificates in Kubernetes expired?

In Kubernetes, the certificates used for authenticating cluster components (such as the API server, kubelet, controllers) have an expiration date. By default, the certificates may be valid for about one year.

To check if the certificates have expired, you can:

• Use the command kubeadm certs check-expiration (if the cluster was created with kubeadm). It will show the expiration date of each certificate.
• Manually check the certificate files (usually in /etc/kubernetes/pki/) using the openssl command:

openssl x509 -in /etc/kubernetes/pki/apiserver.crt -noout -enddate

If the certificates have expired, it can cause cluster failures, so they need to be updated in a timely manner.