Checking Kubernetes (k3s.yaml) Client Certificate Expiry
The k3s.yaml file contains the client certificate used by kubectl to authenticate with the Kubernetes API server. You can check its validity period using the commands below.
Step 1: Verify Certificate Expiry
sudo kubectl --kubeconfig k3s.yaml config view --raw \
-o jsonpath='{.users[0].user.client-certificate-data}' \
| base64 -d \
| openssl x509 -noout -dates
Example Output
notBefore=Oct 9 04:56:37 2024 GMT
notAfter=May 3 13:22:33 2027 GMT
Or, if your kubeconfig is stored elsewhere:
sudo kubectl --kubeconfig /path/to/k3s.yaml config view --raw \
-o jsonpath='{.users[0].user.client-certificate-data}' \
| base64 -d \
| openssl x509 -noout -dates
Updating the k3s.yaml Certificate
The client certificate embedded in k3s.yaml is generated by the k3s server. When the certificate expires (or after certificate rotation), regenerate the kubeconfig.
Step 1: Rotate Certificates (if required)
On the k3s server:
sudo systemctl stop k3s
sudo k3s certificate rotate
sudo systemctl start k3s
For newer k3s versions, you can also rotate specific certificates if needed.
Step 2: Regenerate kubeconfig
The default kubeconfig is located at:
/etc/rancher/k3s/k3s.yaml
Copy it to the required location:
sudo cp /etc/rancher/k3s/k3s.yaml /home/<user>/k3s.yaml
sudo chown <user>:<user> /home/<user>/k3s.yaml
If the server IP or hostname has changed, update the server: field in the copied k3s.yaml.
Example:
clusters:
- cluster:
server: https://<k3s-server-ip>:6443
Step 3: Verify the New Certificate
kubectl --kubeconfig k3s.yaml get nodes
Verify the embedded certificate expiry again:
kubectl --kubeconfig k3s.yaml config view --raw \
-o jsonpath='{.users[0].user.client-certificate-data}' \
| base64 -d \
| openssl x509 -noout -dates
Confirm that the notAfter date reflects the renewed certificate.