Daryl Metzler djmetzle

Howto renew certs on older kubeadm clusters

There's a bug with old versions of kubeadm, in that it can update certificates, but doesn't correctly "wire them in".

Are you trying to connect to the cluster and getting:

$ kubectl <foo>
Unable to connect to the server: x509: certificate has expired or is not yet valid

graph LR
    Clock-->Driver
    Driver-->Printer
    Driver-->Logger

CI/CD

flowchart TD
    dev[developer] -->|pushes to| git
    git[git] -->|triggers| deploy{CI}

    deploy -->|is PR?| preview[preview deploy]
    preview -->|run tests| tested(tests pass)
 tested --&gt;|merge to| git

	#!/bin/bash -e

	S3_BUCKETS=( `aws s3api list-buckets --query "Buckets[].Name" --output=text` )

	for bucket in "${S3_BUCKETS[@]}"; do
	BUCKET_LOGGING=`aws s3api get-bucket-logging --bucket $bucket`
	if [ -n "$BUCKET_LOGGING" ]; then
	echo "$bucket: $BUCKET_LOGGING"
	fi
	done

	require 'socket'
	sock = UDPSocket.new()
	sock.bind('', 8125)
	p sock
	while true do
	p sock.recvfrom(2000)
	end
	sock.close

	GITHUB_ACTIONS='token.actions.githubusercontent.com'
	OIDC_PATH='.well-known/openid-configuration'

	HOST=$(curl https://$GITHUB_ACTIONS/$OIDC_PATH \
	\| jq -r '.jwks_uri \| split("/")[2]')
	echo "Fetching thumbprint for: $HOST"
	RAWCERT=$(echo \| openssl s_client -servername $HOST -showcerts -connect $HOST:443 2> /dev/null)

	CERT=$(echo "$RAWCERT" \| sed -n -e '/BEGIN/h' -e '/BEGIN/,/END/H' -e '$x' -e '$p' \| tail -n +2)
	SSLPRINT=$(openssl x509 -fingerprint -noout <<< $CERT)