Rotation Certificates

Check Items

Check whether the number of certificates on your node is greater than 1000. During an upgrade, certificate files will be processed in batches. An excessive number of certificate files will lead to a slow node upgrade and result in pod eviction from the node.

Solution

Solution 1 (preferred): Reset the node. For details, see Resetting a Node.

Solution 2: Fix the certificate rotation issue on the node.

1. Go to the /opt/cloud/cce/kubernetes/kubelet/pki/ directory on the node.
2. Back up certificate files kubelet-server-current.pem and kubelet-client-current.pem on the node.
3. Delete the residual kubelet-server-* certificate files from the node.

   link_target="$(basename $(readlink kubelet-server-current.pem))" && find -maxdepth 1 -type f -name 'kubelet-server-*.pem' ! -name "$link_target" -delete

4. Delete soft links for the certificates.

   find -maxdepth 1 -type f -name 'kubelet-server-current.pem'  -delete