Certificate expiration is approaching for kubeadm-managed certificates on a civic control plane. Which action reduces the risk of API outages due to expired certs?
Select an answer to reveal the explanation.
Short Explanation
Expired control-plane certs are like letting the building’s badge system lapse—suddenly nobody gets through the door. Renew with kubeadm’s certificate tooling before the calendar bites, and bounce the static pods that still clutch old files. Waiting until the API is already dark is a rough way to learn cert lifetimes.
Full Explanation
kubeadm generates PKI with finite lifetimes for apiserver and related certificates. Proactive renewal via kubeadm certificate commands, followed by reloading control-plane static pods when needed, prevents TLS failures that take the API offline. Ignoring expiration until failure forces emergency recovery under outage pressure.