Budget analytics reports one worker as NotReady and kubelet logs show TLS client authentication failures to the API server. What is the most likely cause?
Select an answer to reveal the explanation.
Short Explanation
Think of the kubelet's client cert like a badge at the city hall door—if it expires, security won't let that node talk to the API, and it shows NotReady. Renewing the kubelet credentials gets the handshake working again.
Full Explanation
Kubelet authenticates to the API server with a client certificate. When that certificate expires, the node can no longer complete TLS client auth, which commonly surfaces as NotReady with authentication errors in kubelet logs. Renewing or rotating the kubelet client certificate restores node registration and heartbeats. Network DNS or PDB issues produce different symptoms and do not typically present as kubelet TLS client auth failures.